From dc0c98dcb983491ab1dbd038e149a9f66936dc55 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 12 Oct 2026 11:27:32 -0700
Subject: [PATCH 01/13] test(mothership): record non-Chat responses of shared
 content routes before gating

Seeds one clean, secret-bearing, unknown and unrecorded item per content store and snapshots
every shared content route as an API-key caller sees it, before any Chat delivery gate changes.
---
 .../content-delivery-compat.baseline.json     | 875 ++++++++++++++++++
 .../content-delivery-compat.integration.ts    | 197 ++++
 .../content-delivery-fixture.ts               | 341 +++++++
 3 files changed, 1413 insertions(+)
 create mode 100644 apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
 create mode 100644 apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
 create mode 100644 apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts

diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
new file mode 100644
index 00000000000..599b668b736
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
@@ -0,0 +1,875 @@
+{
+  "GET /api/v2/workspaces": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "color": "#33C482",
+          "createdAt": "<time>",
+          "id": "<workspace>",
+          "logoUrl": null,
+          "memberCount": 2,
+          "name": "ACL integration fixture",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:clean>",
+          "key": "<minted>",
+          "name": "clean.txt",
+          "size": 50,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:clean>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:entries>",
+          "key": "<minted>",
+          "name": "entries.txt",
+          "size": 64,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:entries>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:unknown>",
+          "key": "<minted>",
+          "name": "unknown.txt",
+          "size": 56,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:unknown>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:unrecorded>",
+          "key": "<minted>",
+          "name": "unrecorded.txt",
+          "size": 59,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:unrecorded>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+  },
+  "GET /api/v2/files/<file:clean>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 50,
+        "charCount": 50,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:clean>",
+        "name": "clean.txt",
+        "path": "files/clean.txt",
+        "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:clean>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:clean>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 50,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+  },
+  "GET /api/v2/files/<file:entries>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 64,
+        "charCount": 64,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:entries>",
+        "name": "entries.txt",
+        "path": "files/entries.txt",
+        "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:entries>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:entries>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 64,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+  },
+  "GET /api/v2/files/<file:unknown>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 56,
+        "charCount": 56,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:unknown>",
+        "name": "unknown.txt",
+        "path": "files/unknown.txt",
+        "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:unknown>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:unknown>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 56,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:unrecorded>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line"
+  },
+  "GET /api/v2/files/<file:unrecorded>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 59,
+        "charCount": 59,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:unrecorded>",
+        "name": "unrecorded.txt",
+        "path": "files/unrecorded.txt",
+        "text": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:unrecorded>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:unrecorded>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 59,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/bulk-download?workspaceId=<workspace>&fileIds=<file:clean>,<file:entries>,<file:unknown>,<file:unrecorded>": {
+    "status": 200,
+    "contentType": "application/zip",
+    "zip": {
+      "clean.txt": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+      "entries.txt": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+      "unknown.txt": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+      "unrecorded.txt": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line"
+    }
+  },
+  "GET /api/v2/files/search?workspaceId=<workspace>&query=second%20line&mode=exact": {
+    "status": 200,
+    "json": {
+      "data": {
+        "complete": true,
+        "count": 4,
+        "indexStatus": {
+          "failedFiles": 0,
+          "partialFiles": 0,
+          "pendingFiles": 0,
+          "readyFiles": 4,
+          "skippedFiles": 0
+        },
+        "results": [
+          {
+            "fileId": "<file:clean>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:entries>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:unknown>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:unrecorded>",
+            "lineNumber": 2,
+            "text": "second line"
+          }
+        ],
+        "truncated": false
+      }
+    }
+  },
+  "PATCH /api/v2/files/<file:unknown>/share": {
+    "status": 200,
+    "json": {
+      "data": {
+        "allowedEmails": [],
+        "authType": "public",
+        "hasPassword": false,
+        "id": "<id>",
+        "isActive": true,
+        "resourceId": "<file:unknown>",
+        "resourceType": "file",
+        "token": "<minted>",
+        "url": "<minted>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "chunkingConfig": {
+            "maxSize": 1024,
+            "minSize": 1,
+            "overlap": 20
+          },
+          "connectorTypes": ["confluence"],
+          "createdAt": "<time>",
+          "deletedAt": null,
+          "description": null,
+          "docCount": 1,
+          "embeddingDimension": 1536,
+          "embeddingModel": "text-embedding-3-small",
+          "folderPath": "/",
+          "id": "<kb>",
+          "name": "Search fixture",
+          "ownerEmail": "<alice>@fixture.test",
+          "tokenCount": 0,
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/knowledge/<kb>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "characterCount": 0,
+          "chunkCount": 0,
+          "createdAt": "<time>",
+          "enabled": true,
+          "fileSize": 64,
+          "filename": "fixture.txt",
+          "id": "<document>",
+          "knowledgeBaseId": "<kb>",
+          "mimeType": "text/plain",
+          "processingStatus": "completed",
+          "tags": {},
+          "tokenCount": 0
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "characterCount": 0,
+        "chunkCount": 0,
+        "connectorId": null,
+        "connectorType": null,
+        "createdAt": "<time>",
+        "enabled": true,
+        "fileSize": 64,
+        "filename": "fixture.txt",
+        "id": "<document>",
+        "knowledgeBaseId": "<kb>",
+        "mimeType": "text/plain",
+        "processingCompletedAt": null,
+        "processingError": null,
+        "processingStartedAt": null,
+        "processingStatus": "completed",
+        "sourceUrl": null,
+        "tags": {},
+        "tokenCount": 0
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "chunkIndex": 0,
+          "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+          "contentLength": 50,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 50,
+          "id": "<chunk:clean>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        },
+        {
+          "chunkIndex": 1,
+          "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+          "contentLength": 64,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 64,
+          "id": "<chunk:entries>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        },
+        {
+          "chunkIndex": 2,
+          "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+          "contentLength": 56,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 56,
+          "id": "<chunk:unknown>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 0,
+        "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+        "contentLength": 50,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 50,
+        "id": "<chunk:clean>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 1,
+        "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+        "contentLength": 64,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 64,
+        "id": "<chunk:entries>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 2,
+        "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+        "contentLength": 56,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 56,
+        "id": "<chunk:unknown>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "POST /api/v2/knowledge/search": {
+    "status": 200,
+    "json": {
+      "data": {
+        "knowledgeBaseIds": ["<kb>"],
+        "query": "second line",
+        "rerankerStatus": "not_requested",
+        "results": [
+          {
+            "chunkIndex": 0,
+            "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          },
+          {
+            "chunkIndex": 1,
+            "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          },
+          {
+            "chunkIndex": 2,
+            "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          }
+        ],
+        "topK": 10,
+        "totalResults": 3
+      }
+    }
+  },
+  "GET /api/v2/tables?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "description": null,
+          "folderPath": "/",
+          "id": "<table>",
+          "job": null,
+          "locks": {
+            "deleteLocked": false,
+            "insertLocked": false,
+            "schemaLocked": false,
+            "updateLocked": false
+          },
+          "maxRows": 9007199254740991,
+          "name": "content_fixture",
+          "ownerEmail": "<alice>@fixture.test",
+          "rowCount": 0,
+          "schema": {
+            "columns": [
+              {
+                "id": "<id>",
+                "name": "note",
+                "required": false,
+                "type": "string",
+                "unique": false
+              }
+            ]
+          },
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/tables/<table>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/tables/<table>/rows?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+          },
+          "id": "<row:clean>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+          },
+          "id": "<row:entries>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+          },
+          "id": "<row:unknown>",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+        },
+        "id": "<row:clean>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+        },
+        "id": "<row:entries>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+        },
+        "id": "<row:unknown>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "POST /api/v2/tables/<table>/query": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+          },
+          "id": "<row:clean>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+          },
+          "id": "<row:entries>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+          },
+          "id": "<row:unknown>",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "POST /api/v2/tables/<table>/rows/search": {
+    "status": 200,
+    "json": {
+      "data": {
+        "matches": [
+          {
+            "column": "note",
+            "ordinal": 0,
+            "rowId": "<row:clean>"
+          },
+          {
+            "column": "note",
+            "ordinal": 1,
+            "rowId": "<row:entries>"
+          },
+          {
+            "column": "note",
+            "ordinal": 2,
+            "rowId": "<row:unknown>"
+          }
+        ],
+        "truncated": false
+      }
+    }
+  },
+  "GET /api/v2/workflows?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "deployedAt": null,
+          "description": null,
+          "folderPath": "/",
+          "id": "<workflow>",
+          "isDeployed": false,
+          "lastRunAt": null,
+          "name": "content fixture <workflow>",
+          "runCount": 0,
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/w/<workflow>",
+          "workspaceId": "<workspace>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>?includeOutput=true&includeFileBase64=true": {
+    "status": 200,
+    "json": {
+      "data": {
+        "blockOutputs": null,
+        "cost": null,
+        "durationMs": null,
+        "endedAt": "<time>",
+        "error": null,
+        "files": [
+          {
+            "base64": "cHVibGljIG5vdGVzIENMRUFOX1BST1ZFTkFOQ0VfVEVYVF85SzEKc2Vjb25kIGxpbmU=",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:clean>",
+            "id": "<run-file:clean>",
+            "name": "clean.txt",
+            "size": 50,
+            "type": "text/plain"
+          },
+          {
+            "base64": "Y29uZmlnIHRva2VuPXNrX2xpdmVfRklYVFVSRV9FTlRSWV9TRUNSRVRfMDEyMzQ1Njc4OQpzZWNvbmQgbGluZQ==",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:entries>",
+            "id": "<run-file:entries>",
+            "name": "entries.txt",
+            "size": 64,
+            "type": "text/plain"
+          },
+          {
+            "base64": "dGFpbnRlZCBleHBvcnQgVU5LTk9XTl9QUk9WRU5BTkNFX0NBTkFSWV83UTIKc2Vjb25kIGxpbmU=",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:unknown>",
+            "id": "<run-file:unknown>",
+            "name": "unknown.txt",
+            "size": 56,
+            "type": "text/plain"
+          }
+        ],
+        "output": {
+          "clean": {
+            "context": "execution",
+            "id": "<run-file:clean>",
+            "key": "<minted>",
+            "name": "clean.txt",
+            "size": 50,
+            "type": "text/plain",
+            "url": "<minted>"
+          },
+          "entries": {
+            "context": "execution",
+            "id": "<run-file:entries>",
+            "key": "<minted>",
+            "name": "entries.txt",
+            "size": 64,
+            "type": "text/plain",
+            "url": "<minted>"
+          },
+          "unknown": {
+            "context": "execution",
+            "id": "<run-file:unknown>",
+            "key": "<minted>",
+            "name": "unknown.txt",
+            "size": 56,
+            "type": "text/plain",
+            "url": "<minted>"
+          }
+        },
+        "paused": null,
+        "runId": "<run>",
+        "startedAt": "<time>",
+        "status": "completed",
+        "trigger": "api",
+        "workflowId": "<workflow>"
+      }
+    }
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:clean>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:entries>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:unknown>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+  }
+}
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
new file mode 100644
index 00000000000..8b159a74361
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
@@ -0,0 +1,197 @@
+/**
+ * Non-Chat callers of every use case that gates Chat's content delivery, compared byte for byte
+ * against a snapshot recorded before the gate existed. API keys, OAuth, MCP and the UI read the
+ * same content, unclassified, whatever its secret provenance: only a Chat surface installs a gate.
+ */
+import { mkdtempSync, readFileSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
+import JSZip from 'jszip'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+/** Admission throughput is not what this suite proves. */
+vi.mock('@/lib/core/rate-limiter', () => rateLimiterMock)
+vi.mock('@/lib/embeddings', async () => ({
+  ...(await import('@/lib/embeddings/client')),
+  assertKnowledgeEmbeddingCapacity: async () => {},
+  embedKnowledge: async (texts: string[]) => ({
+    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+    totalTokens: texts.length,
+    billableTokens: 0,
+    isBYOK: true,
+    modelName: 'text-embedding-3-small',
+    pricingId: 'text-embedding-3-small',
+  }),
+}))
+
+import {
+  type ContentFixture,
+  callV2,
+  removeContentFixture,
+  seedContentFixture,
+} from '@/lib/mothership/__integration__/content-delivery-fixture'
+
+const ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/
+const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
+/** Fields whose value is minted per write: storage keys and share tokens. */
+const MINTED_FIELDS = new Set(['key', 'token', 'url'])
+/** Ranking scores move with whatever else the shared test database indexed; order is pinned below. */
+const UNSTABLE_SCORES = new Set(['rank', 'rankScore', 'similarity'])
+const MINTED_ID = /\b(?:col|row|tbl)_[0-9a-f]{32}\b/g
+
+/** Replaces values minted per run (ids, times, tokens) so two runs of the same calls compare equal. */
+function normalize(value: unknown, labels: Map<string, string>): unknown {
+  if (typeof value === 'string') {
+    if (ISO_TIME.test(value)) return '<time>'
+    let text = value
+    for (const [raw, label] of labels) text = text.split(raw).join(label)
+    return text.replace(UUID, '<id>').replace(MINTED_ID, '<id>')
+  }
+  if (Array.isArray(value)) {
+    const items = value.map((item) => normalize(item, labels))
+    return items.every((item) => typeof (item as { chunkIndex?: unknown })?.chunkIndex === 'number')
+      ? items.sort(
+          (left, right) =>
+            (left as { chunkIndex: number }).chunkIndex -
+            (right as { chunkIndex: number }).chunkIndex
+        )
+      : items
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([key, item]) => [
+          key,
+          (MINTED_FIELDS.has(key) && typeof item === 'string') || UNSTABLE_SCORES.has(key)
+            ? '<minted>'
+            : normalize(item, labels),
+        ])
+    )
+  }
+  return value
+}
+
+async function describeResponse(response: Response, labels: Map<string, string>) {
+  const contentType = response.headers.get('content-type') ?? ''
+  const status = response.status
+  if (contentType.includes('application/json')) {
+    return { status, json: normalize(await response.json(), labels) }
+  }
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (contentType.includes('zip')) {
+    const archive = await JSZip.loadAsync(bytes)
+    const entries: Record<string, string> = {}
+    for (const name of Object.keys(archive.files).sort()) {
+      const entry = archive.files[name]
+      if (!entry.dir) entries[name] = await entry.async('string')
+    }
+    return { status, contentType, zip: normalize(entries, labels) }
+  }
+  return { status, contentType, text: normalize(bytes.toString('utf8'), labels) }
+}
+
+/**
+ * Recorded once on the commit before Chat's delivery gate existed and compared semantically, so
+ * formatting cannot move it. It is evidence, not an expectation to regenerate: a difference here is
+ * a change non-Chat callers would see.
+ */
+const BASELINE: unknown = JSON.parse(
+  readFileSync(path.join(__dirname, 'content-delivery-compat.baseline.json'), 'utf8')
+)
+
+describe('non-Chat callers read sourced content unchanged', () => {
+  let fixture: ContentFixture
+  const labels = new Map<string, string>()
+
+  beforeAll(async () => {
+    fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-compat-'))
+    fixture = await seedContentFixture()
+    labels.set(fixture.ids.workspaceId, '<workspace>')
+    labels.set(fixture.ids.aliceId, '<alice>')
+    labels.set(fixture.ids.organizationId, '<organization>')
+    labels.set(fixture.knowledge.knowledgeBaseId, '<kb>')
+    labels.set(fixture.knowledge.documentId, '<document>')
+    labels.set(fixture.table.tableId, '<table>')
+    labels.set(fixture.run.workflowId, '<workflow>')
+    labels.set(fixture.run.runId, '<run>')
+    for (const [name, id] of Object.entries(fixture.files)) labels.set(id, `<file:${name}>`)
+    for (const [name, id] of Object.entries(fixture.knowledge.chunks))
+      labels.set(id, `<chunk:${name}>`)
+    for (const [name, id] of Object.entries(fixture.table.rows)) labels.set(id, `<row:${name}>`)
+    for (const [name, id] of Object.entries(fixture.run.files)) labels.set(id, `<run-file:${name}>`)
+  }, 120_000)
+
+  afterAll(async () => {
+    if (fixture) await removeContentFixture(fixture)
+    await rm(fixtureStorage.root, { recursive: true, force: true })
+  })
+
+  it('answers every shared content route as it did before the gate', async () => {
+    const ws = fixture.ids.workspaceId
+    const { files, knowledge, table, run } = fixture
+    const kb = `/api/v2/knowledge/${knowledge.knowledgeBaseId}`
+    const calls: Array<[string, string, unknown?]> = [
+      ['GET', '/api/v2/workspaces'],
+      ['GET', `/api/v2/files?workspaceId=${ws}`],
+      ...Object.values(files).flatMap(
+        (id): Array<[string, string]> => [
+          ['GET', `/api/v2/files/${id}?workspaceId=${ws}`],
+          ['GET', `/api/v2/files/${id}/text?workspaceId=${ws}`],
+          ['GET', `/api/v2/files/${id}/versions?workspaceId=${ws}`],
+        ]
+      ),
+      ['GET', `/api/v2/files/bulk-download?workspaceId=${ws}&fileIds=${Object.values(files)}`],
+      ['GET', `/api/v2/files/search?workspaceId=${ws}&query=second%20line&mode=exact`],
+      [
+        'PATCH',
+        `/api/v2/files/${files.unknown}/share`,
+        { workspaceId: ws, isActive: true, authType: 'public' },
+      ],
+      ['GET', `/api/v2/knowledge?workspaceId=${ws}`],
+      ['GET', `${kb}/documents?workspaceId=${ws}`],
+      ['GET', `${kb}/documents/${knowledge.documentId}?workspaceId=${ws}`],
+      ['GET', `${kb}/documents/${knowledge.documentId}/chunks?workspaceId=${ws}`],
+      ...Object.values(knowledge.chunks).map((id): [string, string] => [
+        'GET',
+        `${kb}/documents/${knowledge.documentId}/chunks/${id}?workspaceId=${ws}`,
+      ]),
+      [
+        'POST',
+        '/api/v2/knowledge/search',
+        { workspaceId: ws, knowledgeBaseIds: [knowledge.knowledgeBaseId], query: 'second line' },
+      ],
+      ['GET', `/api/v2/tables?workspaceId=${ws}`],
+      ['GET', `/api/v2/tables/${table.tableId}/rows?workspaceId=${ws}`],
+      ...Object.values(table.rows).map((id): [string, string] => [
+        'GET',
+        `/api/v2/tables/${table.tableId}/rows/${id}?workspaceId=${ws}`,
+      ]),
+      ['POST', `/api/v2/tables/${table.tableId}/query`, { workspaceId: ws }],
+      ['POST', `/api/v2/tables/${table.tableId}/rows/search`, { workspaceId: ws, q: 'second' }],
+      ['GET', `/api/v2/workflows?workspaceId=${ws}`],
+      [
+        'GET',
+        `/api/v2/workflows/${run.workflowId}/runs/${run.runId}?includeOutput=true&includeFileBase64=true`,
+      ],
+      ...Object.values(run.files).map((id): [string, string] => [
+        'GET',
+        `/api/v2/workflows/${run.workflowId}/runs/${run.runId}/files/${id}`,
+      ]),
+    ]
+    const observed: Record<string, unknown> = {}
+    for (const [method, route, body] of calls) {
+      const key = `${method} ${normalize(route, labels)}`
+      observed[key] = await describeResponse(await callV2(fixture, method, route, body), labels)
+    }
+    expect(observed).toEqual(BASELINE)
+  }, 120_000)
+})
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
new file mode 100644
index 00000000000..5fd661f05b9
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
@@ -0,0 +1,341 @@
+import { createHash } from 'node:crypto'
+import { db } from '@sim/db'
+import {
+  apiKey,
+  auditLog,
+  document,
+  embedding,
+  embeddingSecretProvenance,
+  organization,
+  user,
+  userTableRowSecretProvenance,
+  workflow,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
+  workspace,
+  workspaceFileSearchRevision,
+} from '@sim/db/schema'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { NextRequest } from 'next/server'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { hashApiKey } from '@/lib/api-key/crypto'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { embeddingVectorValues } from '@/lib/knowledge/vector-columns'
+import { uploadExecutionFile } from '@/lib/uploads/contexts/execution/execution-file-manager'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
+
+export const ORIGIN = 'http://localhost:3000'
+
+/** A literal no store vouches for: every canary is one of these, so a leak names its source. */
+export const CANARY = {
+  unknown: 'UNKNOWN_PROVENANCE_CANARY_7Q2',
+  unrecorded: 'UNRECORDED_PROVENANCE_TEXT_4M8',
+  clean: 'CLEAN_PROVENANCE_TEXT_9K1',
+  secret: 'sk_live_FIXTURE_ENTRY_SECRET_0123456789',
+} as const
+
+/** Classifications every content store is seeded with, one item each. */
+export type SeededClassification = 'clean' | 'entries' | 'unknown' | 'unrecorded'
+
+export interface ContentFixture {
+  ids: ReturnType<typeof createKnowledgeAclFixtureIds>
+  personalKey: string
+  files: Record<SeededClassification, string>
+  knowledge: {
+    knowledgeBaseId: string
+    documentId: string
+    chunks: Record<Exclude<SeededClassification, 'unrecorded'>, string>
+  }
+  table: { tableId: string; rows: Record<Exclude<SeededClassification, 'unrecorded'>, string> }
+  run: {
+    workflowId: string
+    runId: string
+    files: Record<Exclude<SeededClassification, 'unrecorded'>, string>
+  }
+}
+
+function sha256(value: string): string {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+/** The text each seeded item holds: the canary its classification names, beside shared prose. */
+export function seededText(classification: SeededClassification): string {
+  switch (classification) {
+    case 'clean':
+      return `public notes ${CANARY.clean}\nsecond line`
+    case 'entries':
+      return `config token=${CANARY.secret}\nsecond line`
+    case 'unknown':
+      return `tainted export ${CANARY.unknown}\nsecond line`
+    case 'unrecorded':
+      return `untracked upload ${CANARY.unrecorded}\nsecond line`
+  }
+}
+
+async function exactEntries(ids: ContentFixture['ids']) {
+  return [
+    {
+      encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+      sourceUserId: ids.aliceId,
+      sourceWorkspaceId: ids.workspaceId,
+      name: 'FIXTURE_TOKEN',
+    },
+  ]
+}
+
+/**
+ * Invokes a generated v2 route exactly as a deployed request reaches it: the real handler,
+ * authenticated by the fixture's personal API key.
+ */
+export async function callV2(
+  fixture: Pick<ContentFixture, 'personalKey'>,
+  method: string,
+  path: string,
+  body?: unknown
+): Promise<Response> {
+  const url = new URL(path, ORIGIN)
+  const matched = matchV2Route(url.pathname)
+  if (!matched) throw new Error(`No v2 route for ${url.pathname}`)
+  const handler = Reflect.get(await matched.load(), method)
+  if (typeof handler !== 'function') throw new Error(`No ${method} handler for ${url.pathname}`)
+  const request = new NextRequest(url, {
+    method,
+    headers: {
+      'x-api-key': fixture.personalKey,
+      'x-forwarded-for': '127.0.0.1',
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  })
+  const response: unknown = await handler(request, { params: Promise.resolve(matched.params) })
+  if (!(response instanceof Response)) throw new Error('Route returned no response')
+  return response
+}
+
+async function seedFiles(ids: ContentFixture['ids']): Promise<ContentFixture['files']> {
+  const provenance: Record<SeededClassification, WorkspaceFileSecretProvenance> = {
+    clean: { status: 'exact', entries: [] },
+    entries: { status: 'exact', entries: await exactEntries(ids) },
+    unknown: { status: 'unknown' },
+    unrecorded: { status: 'unrecorded' },
+  }
+  const files = {} as ContentFixture['files']
+  for (const classification of ['clean', 'entries', 'unknown', 'unrecorded'] as const) {
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from(seededText(classification)),
+      `${classification}.txt`,
+      'text/plain',
+      { secretProvenance: provenance[classification], notifyWorkspaceChange: false }
+    )
+    files[classification] = file.id
+    const dispatchedAt = new Date()
+    const sourceContentUpdatedAt = file.contentUpdatedAt ?? new Date()
+    await db
+      .insert(workspaceFileSearchRevision)
+      .values({
+        fileId: file.id,
+        workspaceId: ids.workspaceId,
+        sourceContentUpdatedAt,
+        status: 'pending',
+        dispatchedAt,
+      })
+      .onConflictDoUpdate({
+        target: workspaceFileSearchRevision.fileId,
+        set: { status: 'pending', dispatchedAt, sourceContentUpdatedAt, buildId: null },
+      })
+    await indexWorkspaceFileForSearch(
+      {
+        workspaceId: ids.workspaceId,
+        fileId: file.id,
+        sourceContentUpdatedAt: sourceContentUpdatedAt.toISOString(),
+        dispatchToken: dispatchedAt.toISOString(),
+      },
+      new AbortController().signal
+    )
+  }
+  return files
+}
+
+async function seedKnowledge(ids: ContentFixture['ids']): Promise<ContentFixture['knowledge']> {
+  const documentId = generateId()
+  await db.insert(document).values({
+    id: documentId,
+    knowledgeBaseId: ids.knowledgeBaseId,
+    filename: 'fixture.txt',
+    fileUrl: `https://fixture.invalid/${documentId}`,
+    fileSize: 64,
+    mimeType: 'text/plain',
+    processingStatus: 'completed',
+    acl: ['ws'],
+    aclRequirements: [],
+    aclVerifiedAt: new Date(),
+  })
+  const entries = await exactEntries(ids)
+  const chunks = {} as ContentFixture['knowledge']['chunks']
+  let chunkIndex = 0
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const id = generateId()
+    const content = seededText(classification)
+    await db.insert(embedding).values({
+      id,
+      documentId,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      chunkIndex: chunkIndex++,
+      chunkHash: sha256(content),
+      content,
+      contentLength: content.length,
+      tokenCount: 8,
+      startOffset: 0,
+      endOffset: content.length,
+      embeddingModel: 'text-embedding-3-small',
+      ...embeddingVectorValues(1536, [1, chunkIndex / 10, ...Array<number>(1534).fill(0)]),
+      ...(classification === 'clean' ? {} : { secretProvenanceVersion: 1 }),
+    })
+    if (classification === 'entries') {
+      await db.insert(embeddingSecretProvenance).values({
+        embeddingId: id,
+        contentHash: sha256(content),
+        status: 'exact',
+        entries,
+      })
+    }
+    chunks[classification] = id
+  }
+  return { knowledgeBaseId: ids.knowledgeBaseId, documentId, chunks }
+}
+
+async function seedTable(
+  fixture: Pick<ContentFixture, 'personalKey' | 'ids'>
+): Promise<ContentFixture['table']> {
+  const workspaceId = fixture.ids.workspaceId
+  const created = await callV2(fixture, 'POST', '/api/v2/tables', {
+    workspaceId,
+    name: 'content_fixture',
+    schema: { columns: [{ name: 'note', type: 'string' }] },
+  })
+  if (created.status !== 201) throw new Error(`Table fixture failed: ${await created.text()}`)
+  const tableId: string = (await created.json()).data.id
+  const rows = {} as ContentFixture['table']['rows']
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const inserted = await callV2(fixture, 'POST', `/api/v2/tables/${tableId}/rows`, {
+      workspaceId,
+      data: { note: seededText(classification) },
+    })
+    if (inserted.status !== 201) throw new Error(`Row fixture failed: ${await inserted.text()}`)
+    rows[classification] = (await inserted.json()).data.id
+  }
+  const columnEntries = (await exactEntries(fixture.ids)).map((entry) => ({
+    ...entry,
+    columnId: 'note',
+  }))
+  /** v2 inserts already bind an exact-empty sidecar; only its classification is rewritten. */
+  await db
+    .update(userTableRowSecretProvenance)
+    .set({ entries: columnEntries })
+    .where(eq(userTableRowSecretProvenance.rowId, rows.entries))
+  await db
+    .update(userTableRowSecretProvenance)
+    .set({ status: 'unknown' })
+    .where(eq(userTableRowSecretProvenance.rowId, rows.unknown))
+  return { tableId, rows }
+}
+
+async function seedRun(ids: ContentFixture['ids']): Promise<ContentFixture['run']> {
+  const workflowId = generateId()
+  const runId = generateId()
+  const snapshotId = generateId()
+  const now = new Date()
+  await db.insert(workflow).values({
+    id: workflowId,
+    userId: ids.aliceId,
+    workspaceId: ids.workspaceId,
+    name: `content fixture ${workflowId}`,
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(workflowExecutionSnapshots).values({
+    id: snapshotId,
+    workflowId,
+    stateHash: snapshotId,
+    stateData: {},
+  })
+  const context = { workspaceId: ids.workspaceId, workflowId, executionId: runId }
+  const entries = await exactEntries(ids)
+  const provenance = {
+    clean: { status: 'exact', entries: [] },
+    entries: { status: 'exact', entries },
+    unknown: { status: 'unknown' },
+  } as const
+  const outputs: Record<string, unknown> = {}
+  const files = {} as ContentFixture['run']['files']
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const file = await uploadExecutionFile(
+      context,
+      Buffer.from(seededText(classification)),
+      `${classification}.txt`,
+      'text/plain',
+      ids.aliceId,
+      provenance[classification]
+    )
+    files[classification] = file.id
+    outputs[classification] = file
+  }
+  await db.insert(workflowExecutionLogs).values({
+    id: generateId(),
+    workflowId,
+    workspaceId: ids.workspaceId,
+    executionId: runId,
+    stateSnapshotId: snapshotId,
+    level: 'info',
+    status: 'completed',
+    trigger: 'api',
+    startedAt: now,
+    endedAt: now,
+    executionData: { finalOutput: outputs, traceSpans: [] },
+  })
+  return { workflowId, runId, files }
+}
+
+/** One workspace holding a clean, a secret-bearing, an unknown and an unrecorded item per store. */
+export async function seedContentFixture(): Promise<ContentFixture> {
+  const ids = createKnowledgeAclFixtureIds()
+  await seedKnowledgeAclFixture(ids)
+  const personalKey = `sk-sim-fixture-${generateId()}`
+  await db.insert(apiKey).values({
+    id: generateId(),
+    userId: ids.aliceId,
+    name: 'Content fixture',
+    key: personalKey,
+    keyHash: hashApiKey(personalKey),
+    type: 'personal',
+  })
+  const files = await seedFiles(ids)
+  const knowledge = await seedKnowledge(ids)
+  const table = await seedTable({ ids, personalKey })
+  const run = await seedRun(ids)
+  return { ids, personalKey, files, knowledge, table, run }
+}
+
+export async function removeContentFixture(fixture: ContentFixture): Promise<void> {
+  const { ids } = fixture
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await db
+    .delete(workflowExecutionLogs)
+    .where(eq(workflowExecutionLogs.workspaceId, ids.workspaceId))
+  await db
+    .delete(workflowExecutionSnapshots)
+    .where(eq(workflowExecutionSnapshots.workflowId, fixture.run.workflowId))
+  await db.delete(workspace).where(eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+}

From 08ca099ca5447577ad57f707cbde846a36d829b7 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 12 Oct 2026 13:22:24 -0700
Subject: [PATCH 02/13] fix(mothership): admit stored content to Chat per item
 through one gate

Content from workspace files, run files, knowledge and table rows now reaches
Chat's model only after each item is classified and admitted by the gate of
the surface it leaves through: the registry gate (Chat tools, CLI, mounts) or
the session gate (run_code sandbox proxy). Unknown items are excluded per
item instead of withholding whole results; items with recorded secrets are
redacted where text, refused where opaque. Non-Chat callers are unchanged.

Every operation that admits Copilot declares contentDelivery, and a sourced
use case must account for what it returns, or Chat's transports refuse the
response. Closes the bulk-download, search, run-file, base64, knowledge,
share, export, table and tools-execute paths, and redacts grep lines before
clipping them.
---
 .claude/rules/sim-content-delivery.md         |  81 +++
 .cursor/rules/sim-content-delivery.mdc        |  77 ++
 apps/sim/AGENTS.md                            |   1 +
 apps/sim/app/api/v2/lib/response.ts           |   5 +
 .../lib/application/operations.ts             |   1 +
 .../application/operations.ts                 |  11 +
 .../sim/lib/api-key/application/operations.ts |   6 +
 .../api-key/application/workspace-api-keys.ts |   3 +
 .../server/routes/copilot-content-routes.json | 162 +++++
 .../server/routes/copilot-refused-routes.json |  10 +
 .../api/server/routes/copilot-request.test.ts |   1 +
 .../lib/api/server/routes/copilot-request.ts  |   2 +
 .../routes/copilot-route-inventory.test.ts    |  35 +
 .../lib/audit-logs/application/operations.ts  |   4 +
 .../member-usage-limits/operations.ts         |   2 +
 .../sim/lib/billing/application/operations.ts |   4 +
 .../organization-usage/operations.ts          |   7 +
 .../sim/lib/catalog/application/operations.ts |   5 +
 .../lib/changelog/application/availability.ts |   1 +
 .../lib/changelog/application/operations.ts   |   3 +
 .../application/operations.ts                 |   5 +
 .../authorized-workspace-use-case.ts          |  44 +-
 .../core/application/content-delivery.test.ts | 346 +++++++++
 .../lib/core/application/content-delivery.ts  | 392 +++++++++++
 apps/sim/lib/core/application/operation.ts    |  31 +
 .../organization-authorization.test.ts        |   1 +
 .../application/organization-operation.ts     |   2 +
 .../workspace-authorization.test.ts           |   1 +
 .../application/workspace-operation.test.ts   |   3 +
 .../core/application/workspace-operation.ts   |  14 +
 .../application/operations.ts                 |   1 +
 .../application/organization-access.ts        |   2 +
 .../organization-account-management.ts        |   6 +
 .../application/organization-accounts.ts      |   4 +
 .../lib/credentials/application/operations.ts |  15 +
 .../resolve-organization-personal-token.ts    |   2 +
 .../custom-tools/application/operations.ts    |   7 +
 .../dashboards/application/availability.ts    |   1 +
 .../lib/dashboards/application/operations.ts  |   2 +
 .../lib/data-drains/application/operations.ts |   8 +
 .../durable-secret-provenance-telemetry.ts    |   4 +
 .../sandbox/brokers/workspace-file.ts         |   5 +
 apps/sim/lib/execution/sandbox/run-task.ts    |   4 +
 apps/sim/lib/execution/sandbox/types.ts       |   5 +
 apps/sim/lib/file-parsers/json-parser.test.ts |  25 +
 apps/sim/lib/file-parsers/json-parser.ts      |  16 +-
 .../application/execute-chat-function.ts      |   2 +
 .../application/operations.ts                 |   1 +
 .../application/list-workspace-invitations.ts |   1 +
 .../application/manage-invitation.ts          |   4 +
 .../lib/invitations/application/operations.ts |   1 +
 .../application/send-invitation-batch.ts      |   1 +
 ...xecution-archive-provenance.integration.ts |  19 +-
 .../upload-read-provenance.integration.ts     |   1 -
 .../application/add-workspace-files.ts        |  46 +-
 .../application/admit-knowledge-content.ts    |  65 ++
 .../authorized-knowledge-use-case.ts          |  20 +-
 apps/sim/lib/knowledge/application/chunks.ts  |  43 +-
 .../lib/knowledge/application/connectors.ts   |  11 +-
 .../lib/knowledge/application/documents.ts    |  36 +-
 .../lib/knowledge/application/operations.ts   |  63 +-
 .../read-original-document.test.ts            |  47 +-
 .../application/read-original-document.ts     |  34 +-
 apps/sim/lib/knowledge/application/search.ts  |  19 +-
 apps/sim/lib/knowledge/application/tags.ts    |  20 +-
 apps/sim/lib/knowledge/secret-provenance.ts   |  58 ++
 apps/sim/lib/logs/application/operations.ts   |   3 +
 apps/sim/lib/mcp/application/operations.ts    |  18 +
 .../content-delivery-fixture.ts               |  49 +-
 .../content-delivery.integration.ts           | 661 ++++++++++++++++++
 .../mothership/agent-cli/engines/file-read.ts |  30 +-
 .../agent-cli/engines/observe-private-file.ts |   6 +
 .../agent-cli/engines/universal-grep.ts       |  45 +-
 .../agent-cli/file-provenance.test.ts         | 244 +++++--
 .../agent-cli/file-read-transport.ts          | 234 ++-----
 apps/sim/lib/mothership/agent-cli/index.ts    |   1 +
 .../agent-cli/table-read-transport.test.ts    | 287 --------
 .../agent-cli/table-read-transport.ts         | 130 ----
 .../sim/lib/mothership/agent-cli/transport.ts |  36 +-
 apps/sim/lib/mothership/agent-cli/types.ts    |   6 +
 .../application/application-adapter.test.ts   |   3 +
 .../lib/mothership/application/operations.ts  |   2 +
 .../application/workspace-target.ts           |   1 +
 .../application/authorized-chat-use-case.ts   |  16 +-
 .../chat/application/inline-images.test.ts    |  43 +-
 .../chat/application/inline-images.ts         |  53 +-
 .../mothership/chat/application/operations.ts |   3 +
 .../chat/application/read-attachment.ts       |  11 +
 .../application/read-sandbox-file.test.ts     |  57 +-
 .../chat/application/read-sandbox-file.ts     |  35 +-
 .../chat/application/workspace-context.ts     |   2 +
 .../chat/application/workspace-target.ts      |   2 +
 .../lib/mothership/chat/organization-chats.ts |   7 +
 .../lib/mothership/chat/process-contents.ts   |  61 +-
 .../content-delivery/dispatch.test.ts         | 136 ++++
 .../mothership/content-delivery/dispatch.ts   |  51 ++
 .../content-delivery/registry-gate.test.ts    | 153 ++++
 .../content-delivery/registry-gate.ts         |  83 +++
 .../content-delivery/session-gate.test.ts     |  84 +++
 .../content-delivery/session-gate.ts          |  72 ++
 .../mothership/content-delivery/telemetry.ts  |  64 ++
 .../integrations/application/catalog.ts       |   2 +
 .../request/application/read-control.ts       |   2 +
 .../tasks/application/operations.ts           |   4 +
 .../lib/mothership/tool-executor/executor.ts  |  22 +
 .../function-execute-file-mounts.test.ts      | 216 +++---
 .../function-execute-table-mounts.test.ts     |  25 +-
 .../tools/handlers/function-execute.ts        | 153 ++--
 .../workbench-confidentiality.live.test.ts    |  97 ++-
 .../tools/sandbox-catalog-routes.test.ts      |  27 -
 .../tools/sandbox-catalog-routes.ts           |  27 -
 .../tools/sandbox-resource-transport.test.ts  |  63 +-
 .../tools/sandbox-resource-transport.ts       | 120 +---
 .../tools/server/files/doc-compile.ts         |  26 +-
 .../tools/server/files/file-preview.ts        |  22 +-
 .../mothership/tools/server/media/ffmpeg.ts   |  23 +-
 .../application/operations.ts                 |   2 +
 .../application/configuration-operations.ts   |   6 +
 .../application/member-roster.ts              |   1 +
 .../organizations/application/operations.ts   |   9 +
 .../application/operations.ts                 |   2 +
 .../lib/sandboxes/application/operations.ts   |   5 +
 .../sim/lib/secrets/application/operations.ts |   5 +
 .../lib/selectors/application/operations.ts   |   1 +
 apps/sim/lib/settings/application/context.ts  |   1 +
 apps/sim/lib/sim-search/live/application.ts   |   5 +
 apps/sim/lib/skills/application/operations.ts |  10 +
 apps/sim/lib/table/application/operations.ts  | 117 ++--
 .../table/application/read-table-snapshot.ts  |  17 +-
 .../application/row-delivery-observer.ts      |  40 --
 apps/sim/lib/table/application/rows.test.ts   | 230 +++---
 apps/sim/lib/table/application/rows.ts        | 243 ++++---
 apps/sim/lib/table/import-data.ts             |   5 +-
 apps/sim/lib/table/import-provenance.ts       |  43 ++
 apps/sim/lib/table/import-runner.ts           |   5 +
 apps/sim/lib/table/rows/secret-provenance.ts  | 236 +++++--
 .../application/execute-tool.test.ts          |  28 +
 .../application/execute-tool.ts               |  13 +-
 .../tool-execution/application/operations.ts  |   1 +
 .../organization-assistant/application.ts     |   1 +
 .../file-versions.integration.ts              | 156 ++---
 .../workspace-file-secret-provenance.ts       | 242 +++++--
 .../application/availability.ts               |   1 +
 .../workflow-tests/application/operations.ts  |   5 +
 .../application/admit-run-files.test.ts       | 196 ++++++
 .../workflows/application/admit-run-files.ts  | 122 ++++
 .../download-workflow-run-file.test.ts        |  67 +-
 .../application/download-workflow-run-file.ts |   5 +
 .../application/execute-manual-workflow.ts    |  16 +-
 .../workflows/application/execute-workflow.ts |   9 +-
 .../lib/workflows/application/operations.ts   |  44 ++
 .../application/read-workflow-run.ts          |  18 +-
 .../lib/workflows/application/resume-run.ts   |   5 +-
 .../custom-blocks/application/settings.ts     |   5 +
 .../workflows/executor/execution-run-files.ts |   8 +-
 .../copilot-file-versions.integration.ts      |  14 +-
 .../lib/workspace-files/api/route-policies.ts |  13 +-
 .../application/admit-file-content.ts         | 136 ++++
 .../download-workspace-file-items.test.ts     |  86 ++-
 .../download-workspace-file-items.ts          |  33 +-
 .../download-workspace-file.test.ts           |  86 ++-
 .../application/download-workspace-file.ts    |  49 +-
 .../edit-workspace-file-content.ts            |   6 +
 .../export-workspace-file-snapshot.ts         |   3 +
 .../fetch-servable-workspace-file-buffer.ts   |  10 +-
 .../application/file-delivery-observer.ts     |  55 --
 .../application/file-versions.ts              |  21 +-
 .../workspace-files/application/operations.ts |  30 +-
 ...ead-stored-workspace-file-record-by-key.ts |  15 +-
 .../read-workspace-file-artifact.test.ts      |  68 +-
 .../read-workspace-file-artifact.ts           |  25 +-
 .../read-workspace-file-content-by-key.ts     |  10 +-
 .../read-workspace-file-content.ts            |   3 +
 .../application/read-workspace-file-mount.ts  |  67 +-
 .../application/read-workspace-file-record.ts |   9 +-
 .../read-workspace-file-secret-provenance.ts  |   5 +-
 .../read-workspace-file-text.test.ts          |  67 +-
 .../application/read-workspace-file-text.ts   |  70 +-
 .../application/read-workspace-inline-file.ts |   3 +
 .../resolve-rendered-workspace-artifact.ts    |   3 +-
 .../resolve-workspace-file-reference.ts       |   5 +-
 .../search-workspace-file-content.ts          |  22 +-
 .../application/share-workspace-file.test.ts  | 103 ++-
 .../application/share-workspace-file.ts       |  49 +-
 .../update-workspace-file-content.ts          |  16 +-
 .../workspaces/application/inbox-settings.ts  |   2 +
 .../application/manage-permissions.ts         |   2 +
 .../lib/workspaces/application/operations.ts  |   2 +
 .../application/organization-operations.ts    |   2 +
 .../workspaces/application/remove-member.ts   |   1 +
 .../lib/workspaces/operations/operations.ts   |   1 +
 apps/sim/tools/index.ts                       |   8 +
 packages/testing/src/mocks/tools.mock.ts      |   3 +
 .../workspace-file-secret-provenance.mock.ts  |   9 +-
 scripts/check-unused-exports.baseline.json    |   2 -
 195 files changed, 6411 insertions(+), 2005 deletions(-)
 create mode 100644 .claude/rules/sim-content-delivery.md
 create mode 100644 .cursor/rules/sim-content-delivery.mdc
 create mode 100644 apps/sim/lib/api/server/routes/copilot-content-routes.json
 create mode 100644 apps/sim/lib/core/application/content-delivery.test.ts
 create mode 100644 apps/sim/lib/core/application/content-delivery.ts
 create mode 100644 apps/sim/lib/knowledge/application/admit-knowledge-content.ts
 create mode 100644 apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
 delete mode 100644 apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts
 delete mode 100644 apps/sim/lib/mothership/agent-cli/table-read-transport.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/dispatch.test.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/dispatch.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/registry-gate.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/session-gate.test.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/session-gate.ts
 create mode 100644 apps/sim/lib/mothership/content-delivery/telemetry.ts
 delete mode 100644 apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts
 delete mode 100644 apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts
 delete mode 100644 apps/sim/lib/table/application/row-delivery-observer.ts
 create mode 100644 apps/sim/lib/table/import-provenance.ts
 create mode 100644 apps/sim/lib/workflows/application/admit-run-files.test.ts
 create mode 100644 apps/sim/lib/workflows/application/admit-run-files.ts
 create mode 100644 apps/sim/lib/workspace-files/application/admit-file-content.ts
 delete mode 100644 apps/sim/lib/workspace-files/application/file-delivery-observer.ts

diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
new file mode 100644
index 00000000000..561682b6f9f
--- /dev/null
+++ b/.claude/rules/sim-content-delivery.md
@@ -0,0 +1,81 @@
+---
+description: How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content.
+paths:
+  - "apps/sim/lib/core/application/content-delivery.ts"
+  - "apps/sim/lib/mothership/content-delivery/**"
+  - "apps/sim/lib/**/application/admit-*.ts"
+  - "apps/sim/lib/**/application/operations.ts"
+  - "apps/sim/lib/mothership/agent-cli/**"
+  - "apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"
+---
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, public links, and match results.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links).
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither ever admits `unknown`, and one refused item never
+  latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out | Left out (opaque) | Included |
+| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Compile refused | Error text redacted | Compiles |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export, table export download | Not available to Chat | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
new file mode 100644
index 00000000000..62e2784eaf4
--- /dev/null
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -0,0 +1,77 @@
+---
+description: "How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content."
+globs: ["apps/sim/lib/core/application/content-delivery.ts","apps/sim/lib/mothership/content-delivery/**","apps/sim/lib/**/application/admit-*.ts","apps/sim/lib/**/application/operations.ts","apps/sim/lib/mothership/agent-cli/**","apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"]
+---
+
+<!-- Generated from .claude/rules/sim-content-delivery.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, public links, and match results.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links).
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither ever admits `unknown`, and one refused item never
+  latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out | Left out (opaque) | Included |
+| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Compile refused | Error text redacted | Compiles |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export, table export download | Not available to Chat | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
diff --git a/apps/sim/AGENTS.md b/apps/sim/AGENTS.md
index 9da2a087205..8f3822fa977 100644
--- a/apps/sim/AGENTS.md
+++ b/apps/sim/AGENTS.md
@@ -9,6 +9,7 @@ Applies to `apps/sim/**` on top of the root [AGENTS.md](/AGENTS.md), which holds
 - Styling and emcn chrome, UI copy, settings pages: `sim-styling.md`, `sim-ui-copy.md`, `sim-settings-pages.md`
 - URL state, list and menu order, caching: `sim-url-state.md`, `sim-list-ordering.md`, `sim-caching.md`
 - Tools, blocks, triggers: `sim-integrations.md`; isolated-vm sandbox worker: `sim-sandbox.md`
+- Anything that returns stored file, run-file, knowledge or table content to Chat: `sim-content-delivery.md`
 - Tests: `sim-testing.md` and the `test-audit` skill
 - Landing pages: `app/(landing)/CLAUDE.md`, `landing-seo-geo.md`, `constitution.md` (product language)
 
diff --git a/apps/sim/app/api/v2/lib/response.ts b/apps/sim/app/api/v2/lib/response.ts
index 30eaa7bb044..140400b8169 100644
--- a/apps/sim/app/api/v2/lib/response.ts
+++ b/apps/sim/app/api/v2/lib/response.ts
@@ -14,6 +14,7 @@ import {
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
 } from '@/lib/core/application'
+import { ContentDeliveryUnobservedError } from '@/lib/core/application/content-delivery'
 import {
   asOrchestrationError,
   OrchestrationError,
@@ -530,6 +531,10 @@ export function v2ErrorForOrchestration(
  * one its failure class maps to.
  */
 export function v2CaughtOrchestrationError(error: unknown): NextResponse | null {
+  /** Chat reached stored content outside any classifying surface: transient, never a content leak. */
+  if (error instanceof ContentDeliveryUnobservedError) {
+    return v2Error('SERVICE_UNAVAILABLE', error.message)
+  }
   const classified = asOrchestrationError(error)
   if (!classified) return null
   if (classified instanceof InsufficientScopeError) return v2InsufficientScope(classified)
diff --git a/apps/sim/ee/access-requests/lib/application/operations.ts b/apps/sim/ee/access-requests/lib/application/operations.ts
index 0af98a38bd9..13a313be0cc 100644
--- a/apps/sim/ee/access-requests/lib/application/operations.ts
+++ b/apps/sim/ee/access-requests/lib/application/operations.ts
@@ -51,6 +51,7 @@ function defineAccessRequestOperation(
          * permission-group-exempt: requests never grant a withheld capability without administrator review.
          */
         capability: 'none',
+        contentDelivery: 'none',
       })
   return Object.freeze({ ...workspaceOperation, organizationOperation, admin })
 }
diff --git a/apps/sim/ee/workspace-forking/application/operations.ts b/apps/sim/ee/workspace-forking/application/operations.ts
index e744d99f92f..878930fe49d 100644
--- a/apps/sim/ee/workspace-forking/application/operations.ts
+++ b/apps/sim/ee/workspace-forking/application/operations.ts
@@ -14,6 +14,7 @@ export const forkOperations = {
   discover: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.discover',
     oauthScope: 'api:read',
   }),
@@ -23,6 +24,7 @@ export const forkOperations = {
   preview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.preview',
     oauthScope: 'api:write',
   }),
@@ -32,6 +34,7 @@ export const forkOperations = {
   create: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.create',
     oauthScope: 'api:write',
   }),
@@ -41,6 +44,7 @@ export const forkOperations = {
   syncPreview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync.preview',
     oauthScope: 'api:write',
   }),
@@ -50,6 +54,7 @@ export const forkOperations = {
   sync: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync',
     oauthScope: 'api:write',
   }),
@@ -59,6 +64,7 @@ export const forkOperations = {
   mappingsRead: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.read',
     oauthScope: 'api:read',
   }),
@@ -68,6 +74,7 @@ export const forkOperations = {
   mappingsUpdate: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.update',
     oauthScope: 'api:write',
   }),
@@ -77,6 +84,7 @@ export const forkOperations = {
   rollback: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.rollback',
     oauthScope: 'api:write',
   }),
@@ -86,6 +94,7 @@ export const forkOperations = {
   unlink: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.unlink',
     oauthScope: 'api:write',
   }),
@@ -95,6 +104,7 @@ export const forkOperations = {
   exclusions: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.exclusions',
     oauthScope: 'api:write',
   }),
@@ -107,6 +117,7 @@ export const forkOperations = {
   syncDefault: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync_default',
     oauthScope: 'api:write',
   }),
diff --git a/apps/sim/lib/api-key/application/operations.ts b/apps/sim/lib/api-key/application/operations.ts
index 52df9771b9c..f71c81cf02c 100644
--- a/apps/sim/lib/api-key/application/operations.ts
+++ b/apps/sim/lib/api-key/application/operations.ts
@@ -33,6 +33,7 @@ export const apiKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -45,6 +46,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -54,12 +56,14 @@ export const byokKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   listOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.list',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -84,6 +88,7 @@ export const byokKeyOperations = {
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   deleteOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.delete',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -100,6 +105,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/api-key/application/workspace-api-keys.ts b/apps/sim/lib/api-key/application/workspace-api-keys.ts
index 9da3e3188b5..7d30ab9c4fb 100644
--- a/apps/sim/lib/api-key/application/workspace-api-keys.ts
+++ b/apps/sim/lib/api-key/application/workspace-api-keys.ts
@@ -31,12 +31,14 @@ export const workspaceApiKeyOperations = {
     id: 'api_keys.workspace.list',
     minimumRole: 'read',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   rename: defineWorkspaceOperation({
     ...principalPolicy,
     id: 'api_keys.workspace.rename',
     minimumRole: 'admin',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   /** permission-group-exempt: admins must retain the ability to revoke exposed credentials. */
   revoke: defineWorkspaceOperation({
@@ -44,6 +46,7 @@ export const workspaceApiKeyOperations = {
     id: 'api_keys.workspace.revoke',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 const authorizationOptions = { delegation: { audience: 'sim:settings', isWithinScope: () => true } }
diff --git a/apps/sim/lib/api/server/routes/copilot-content-routes.json b/apps/sim/lib/api/server/routes/copilot-content-routes.json
new file mode 100644
index 00000000000..530c83f405f
--- /dev/null
+++ b/apps/sim/lib/api/server/routes/copilot-content-routes.json
@@ -0,0 +1,162 @@
+[
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]",
+    "operation": "files.download"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/files/[fileId]/content",
+    "operation": "files.update_content"
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v2/files/[fileId]/content",
+    "operation": "files.update_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/share",
+    "operation": "files.share.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/files/[fileId]/share",
+    "operation": "files.share.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/text",
+    "operation": "files.read_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/versions/[version]/text",
+    "operation": "files.versions.read_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/bulk-download",
+    "operation": "files.download"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/search",
+    "operation": "files.search_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/connectors/[connectorId]/documents",
+    "operation": "knowledge.connectors.documents.list"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents",
+    "operation": "knowledge.documents.list"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]",
+    "operation": "knowledge.documents.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]",
+    "operation": "knowledge.documents.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks",
+    "operation": "knowledge.chunks.list"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks",
+    "operation": "knowledge.chunks.create"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks/[chunkId]",
+    "operation": "knowledge.chunks.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks/[chunkId]",
+    "operation": "knowledge.chunks.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/tags/usage",
+    "operation": "knowledge.tags.read_usage"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/knowledge/search",
+    "operation": "knowledge.search"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/query",
+    "operation": "tables.rows.query"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/query/count",
+    "operation": "tables.rows.query"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows",
+    "operation": "tables.rows.list"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/rows",
+    "operation": "tables.rows.create"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]",
+    "operation": "tables.rows.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]",
+    "operation": "tables.rows.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]/enrichment/[groupId]",
+    "operation": "tables.rows.read"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/rows/search",
+    "operation": "tables.rows.search"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/rows/upsert",
+    "operation": "tables.rows.upsert"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/workflows/[workflowId]/execute",
+    "operation": "workflows.execute"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]",
+    "operation": "workflows.runs.read"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]/files/[fileId]",
+    "operation": "workflows.download_run_file"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]/resume",
+    "operation": "workflows.runs.resume"
+  }
+]
diff --git a/apps/sim/lib/api/server/routes/copilot-refused-routes.json b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
index eacd2e4df6b..58731b33a67 100644
--- a/apps/sim/lib/api/server/routes/copilot-refused-routes.json
+++ b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
@@ -14,6 +14,11 @@
     "path": "/api/v2/files/[fileId]/versions/[version]/content",
     "operation": "files.versions.download"
   },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/export",
+    "operation": "knowledge.export"
+  },
   {
     "method": "GET",
     "path": "/api/v2/meta",
@@ -229,6 +234,11 @@
     "path": "/api/v2/organizations/[organizationId]/workspaces",
     "operation": "organizations.workspaces.list"
   },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/exports/[exportId]/download",
+    "operation": "tables.exports.download"
+  },
   {
     "method": "GET",
     "path": "/api/v2/workspaces",
diff --git a/apps/sim/lib/api/server/routes/copilot-request.test.ts b/apps/sim/lib/api/server/routes/copilot-request.test.ts
index ae34e4a1e31..2212c1d8387 100644
--- a/apps/sim/lib/api/server/routes/copilot-request.test.ts
+++ b/apps/sim/lib/api/server/routes/copilot-request.test.ts
@@ -36,6 +36,7 @@ const policy = {
 
 const operation = defineWorkspaceOperation({
   id: 'widgets.read',
+  contentDelivery: 'none',
   capability: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
diff --git a/apps/sim/lib/api/server/routes/copilot-request.ts b/apps/sim/lib/api/server/routes/copilot-request.ts
index 15e841b3e2c..e30fe5dafef 100644
--- a/apps/sim/lib/api/server/routes/copilot-request.ts
+++ b/apps/sim/lib/api/server/routes/copilot-request.ts
@@ -1,4 +1,5 @@
 import type { DelegatedPrincipal } from '@sim/auth/principal'
+import { noteContentDeliveryOperation } from '@/lib/core/application/content-delivery'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
 import {
@@ -48,5 +49,6 @@ export function copilotRequestPrincipal(
   if (!audience) return undefined
   const principal = createCopilotChatPrincipal(invocation, audience)
   markCopilotWorkspaceInvocation(principal)
+  noteContentDeliveryOperation(operation, principal)
   return principal
 }
diff --git a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
index 0d02d41f43a..739dc633fbe 100644
--- a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
+++ b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
@@ -80,8 +80,25 @@ import type { ApplicationOperation } from '@/lib/core/application/operation'
  */
 const REFUSED_ROUTES_FILE = './copilot-refused-routes.json'
 
+/**
+ * Routes Chat may call that return content from a provenance-bearing store. Each is gated per
+ * item, and `content-delivery.integration.ts` drives every one through Chat's real transports: a
+ * route added here without a case there fails that suite. Refresh with `vitest run -u`.
+ */
+const CONTENT_ROUTES_FILE = './copilot-content-routes.json'
+
 const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
 
+/** Whether authorization lets a Chat principal through, not only whether the route mints one. */
+function admitsCopilotPrincipal(operation: ApplicationOperation): boolean {
+  const kinds: readonly string[] = operation.principalKinds
+  const services: readonly string[] | undefined = operation.delegatedServices
+  return (
+    (kinds.includes('delegated') || kinds.includes('organization_delegated')) &&
+    (!services || services.includes('copilot'))
+  )
+}
+
 /**
  * A raw route (chat, workflow execute and resume) admits inside its handler, so it is
  * invoked once and its admission call recorded, which ends the request before any work.
@@ -112,4 +129,22 @@ it('inventories private operation admission without executing use cases', async
     .map(({ method, path, operation }) => ({ method, path, operation: operation.id }))
   await expect(`${JSON.stringify(refused, null, 2)}\n`).toMatchFileSnapshot(REFUSED_ROUTES_FILE)
   expect(audiences.filter(Boolean).every((audience) => audience?.startsWith('sim:'))).toBe(true)
+
+  /**
+   * Every route Chat may call says whether it returns stored content, so no route reaches Chat's
+   * model by being forgotten: an undeclared one is listed here, and definition refuses it too.
+   */
+  const admitted = inventory.filter(
+    (route, index) => audiences[index] && admitsCopilotPrincipal(route.operation)
+  )
+  expect(
+    admitted
+      .filter((route) => route.operation.contentDelivery === undefined)
+      .map(({ method, path, operation }) => `${method} ${path} (${operation.id})`)
+  ).toEqual([])
+  const sourced = admitted
+    .filter((route) => route.operation.contentDelivery === 'sourced')
+    .map(({ method, path, operation }) => ({ method, path, operation: operation.id }))
+    .sort((a, b) => `${a.path} ${a.method}`.localeCompare(`${b.path} ${b.method}`))
+  await expect(`${JSON.stringify(sourced, null, 2)}\n`).toMatchFileSnapshot(CONTENT_ROUTES_FILE)
 }, 60000)
diff --git a/apps/sim/lib/audit-logs/application/operations.ts b/apps/sim/lib/audit-logs/application/operations.ts
index 2f56b86ce32..2aa79688df7 100644
--- a/apps/sim/lib/audit-logs/application/operations.ts
+++ b/apps/sim/lib/audit-logs/application/operations.ts
@@ -45,6 +45,7 @@ export const auditLogOperations = {
   // permission-group-exempt: the organization audit trail is authorized by organization admin or owner role, a scope no workspace-shaped permission group can name
   list: defineAuditLogOperation({
     id: 'audit_logs.list',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     authority: 'organization_admin',
@@ -55,6 +56,7 @@ export const auditLogOperations = {
   // permission-group-exempt: same organization-admin authority as the list it expands; no group key names the audit trail
   readDetail: defineAuditLogOperation({
     id: 'audit_logs.read_detail',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     authority: 'organization_admin',
@@ -71,6 +73,7 @@ export const copilotAuditLogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -79,6 +82,7 @@ export const copilotAuditLogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/billing/application/member-usage-limits/operations.ts b/apps/sim/lib/billing/application/member-usage-limits/operations.ts
index b99a9f2e6fc..6f8ee79ef2f 100644
--- a/apps/sim/lib/billing/application/member-usage-limits/operations.ts
+++ b/apps/sim/lib/billing/application/member-usage-limits/operations.ts
@@ -6,6 +6,7 @@ export const memberUsageLimitOperations = {
    */
   read: defineOrganizationOperation({
     id: 'organization_member_usage_limits.read',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -18,6 +19,7 @@ export const memberUsageLimitOperations = {
    */
   update: defineOrganizationOperation({
     id: 'organization_member_usage_limits.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
diff --git a/apps/sim/lib/billing/application/operations.ts b/apps/sim/lib/billing/application/operations.ts
index 9f675b07f32..259c70610df 100644
--- a/apps/sim/lib/billing/application/operations.ts
+++ b/apps/sim/lib/billing/application/operations.ts
@@ -40,6 +40,7 @@ export const billingOperations = {
   // permission-group-exempt: a personal account reading its own plan and balance; permission groups scope a workspace, not the billing account that owns it
   readStatus: defineBillingReadOperation({
     id: 'billing.status.read',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     accountScope: 'personal_self',
@@ -50,6 +51,7 @@ export const billingOperations = {
   // permission-group-exempt: the same personal billing account reading its own usage records; no group key names it
   listLogs: defineBillingReadOperation({
     id: 'billing.logs.list',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     accountScope: 'personal_self',
@@ -66,6 +68,7 @@ export const copilotBillingOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -74,6 +77,7 @@ export const copilotBillingOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/billing/application/organization-usage/operations.ts b/apps/sim/lib/billing/application/organization-usage/operations.ts
index 5d3ca5f4600..cb089dd3bb1 100644
--- a/apps/sim/lib/billing/application/organization-usage/operations.ts
+++ b/apps/sim/lib/billing/application/organization-usage/operations.ts
@@ -44,6 +44,7 @@ export const organizationUsageOperations = {
    */
   readActivitySummary: defineOrganizationOperation({
     id: 'organization_usage.activity.summary.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -52,6 +53,7 @@ export const organizationUsageOperations = {
    */
   readActivityBreakdown: defineOrganizationOperation({
     id: 'organization_usage.activity.breakdown.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -60,6 +62,7 @@ export const organizationUsageOperations = {
    */
   readOverview: defineOrganizationOperation({
     id: 'organization_usage.overview.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -68,6 +71,7 @@ export const organizationUsageOperations = {
    */
   readSummary: defineOrganizationOperation({
     id: 'organization_usage.summary.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -76,6 +80,7 @@ export const organizationUsageOperations = {
    */
   readBreakdown: defineOrganizationOperation({
     id: 'organization_usage.breakdown.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -84,6 +89,7 @@ export const organizationUsageOperations = {
    */
   listEvents: defineOrganizationOperation({
     id: 'organization_usage.events.list',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -92,6 +98,7 @@ export const organizationUsageOperations = {
    */
   exportEvents: defineOrganizationOperation({
     id: 'organization_usage.events.export',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
diff --git a/apps/sim/lib/catalog/application/operations.ts b/apps/sim/lib/catalog/application/operations.ts
index 4c13c97beca..62713f5e349 100644
--- a/apps/sim/lib/catalog/application/operations.ts
+++ b/apps/sim/lib/catalog/application/operations.ts
@@ -27,6 +27,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -43,6 +44,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -59,6 +61,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -75,6 +78,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -95,6 +99,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'knowledge.use',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
diff --git a/apps/sim/lib/changelog/application/availability.ts b/apps/sim/lib/changelog/application/availability.ts
index 211f65dd7f0..69b307ab711 100644
--- a/apps/sim/lib/changelog/application/availability.ts
+++ b/apps/sim/lib/changelog/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/changelog/application/operations.ts b/apps/sim/lib/changelog/application/operations.ts
index efa05caac93..a67e795079d 100644
--- a/apps/sim/lib/changelog/application/operations.ts
+++ b/apps/sim/lib/changelog/application/operations.ts
@@ -12,6 +12,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:read',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.read',
     minimumRole: 'read',
   }),
@@ -19,6 +20,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.publish',
     minimumRole: 'write',
   }),
@@ -26,6 +28,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.update',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/chat-deployments/application/operations.ts b/apps/sim/lib/chat-deployments/application/operations.ts
index 4673eb3023d..f689ad160e5 100644
--- a/apps/sim/lib/chat-deployments/application/operations.ts
+++ b/apps/sim/lib/chat-deployments/application/operations.ts
@@ -54,6 +54,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_LIST_POLICY,
   }),
   replace: defineWorkspaceOperation({
@@ -62,6 +63,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -70,6 +72,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -78,6 +81,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -86,6 +90,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/core/application/authorized-workspace-use-case.ts b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
index d0acf45beee..233c51e9d74 100644
--- a/apps/sim/lib/core/application/authorized-workspace-use-case.ts
+++ b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
@@ -1,6 +1,7 @@
 import { type AuditActionType, type AuditResourceTypeValue, recordAudit } from '@sim/audit'
 import type { Principal, PrincipalAuditAttribution } from '@sim/auth/principal'
 import { resolvePrincipalAuditAttribution } from '@sim/auth/principal'
+import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
 import {
   authorizeWorkspaceOperation,
@@ -214,27 +215,30 @@ export function defineAuthorizedWorkspaceUseCase<
     async execute(args) {
       const executionContext = await authorizePhase(args)
       const { principal, context, request } = executionContext
-      return runWithOutboundOrganization(context.workspaceOrganizationId, async () => {
-        const result = await withinAuthorizedWorkspaceOperation(() =>
-          definition.execute(executionContext)
-        )
-        const resultContext = { ...executionContext, result }
-        const projectedAudit = definition.projectAudit?.(resultContext)
-        if (projectedAudit !== undefined) {
-          const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
-          if (auditEntries.length > 0) {
-            recordProjectedUseCaseAuditEntries(
-              definition.operation,
-              context.workspaceId,
-              principal,
-              request,
-              auditEntries
-            )
+      return runWithOutboundOrganization(context.workspaceOrganizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          principal,
+          () => withinAuthorizedWorkspaceOperation(() => definition.execute(executionContext)),
+          async (result) => {
+            const resultContext = { ...executionContext, result }
+            const projectedAudit = definition.projectAudit?.(resultContext)
+            if (projectedAudit !== undefined) {
+              const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
+              if (auditEntries.length > 0) {
+                recordProjectedUseCaseAuditEntries(
+                  definition.operation,
+                  context.workspaceId,
+                  principal,
+                  request,
+                  auditEntries
+                )
+              }
+            }
+            await definition.afterSuccess?.(resultContext)
           }
-        }
-        await definition.afterSuccess?.(resultContext)
-        return result
-      })
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/core/application/content-delivery.test.ts b/apps/sim/lib/core/application/content-delivery.test.ts
new file mode 100644
index 00000000000..289c1684b50
--- /dev/null
+++ b/apps/sim/lib/core/application/content-delivery.test.ts
@@ -0,0 +1,346 @@
+/**
+ * @vitest-environment node
+ */
+import type { Principal } from '@sim/auth/principal'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  admitContent,
+  admitWrittenContent,
+  type ContentDeliveryGate,
+  ContentDeliveryUnaccountedError,
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  mustClassifyContent,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+  observeContentOutsideModel,
+  requireAdmittedContent,
+  runDeclaredContentOperation,
+  trackContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+
+function delegated(serviceId: string): Principal {
+  const now = Date.now()
+  return {
+    kind: 'delegated',
+    serviceId,
+    subjectUserId: 'user-1',
+    workspaceId: 'workspace-1',
+    delegationId: 'delegation-1',
+    audience: 'sim:test',
+    issuedAt: new Date(now),
+    expiresAt: new Date(now + 60_000),
+  }
+}
+
+const CHAT = delegated('copilot')
+const EXECUTOR = delegated('executor')
+const SESSION: Principal = { kind: 'session', userId: 'user-1', sessionId: 'session-1' }
+
+function operation(contentDelivery: 'sourced' | 'none') {
+  return defineWorkspaceOperation({
+    id: `test.${contentDelivery}`,
+    contentDelivery,
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    principalKinds: ['delegated'],
+    delegatedServices: ['copilot'],
+    capability: 'none',
+  })
+}
+
+const SOURCED = operation('sourced')
+const NONE = operation('none')
+
+function source(id: string, status: 'clean' | 'unknown' = 'clean'): ContentSource {
+  return {
+    kind: 'workspace-file',
+    id,
+    provenance: status === 'clean' ? { status: 'exact', entries: [] } : { status: 'unknown' },
+    view: 'complete',
+  }
+}
+
+/** Admits clean items and refuses unknown ones, recording every batch it was asked about. */
+function recordingGate() {
+  const batches: string[][] = []
+  const gate: ContentDeliveryGate = {
+    async admit(sources) {
+      batches.push(sources.map((item) => item.id))
+      return sources.map((item) => item.provenance.status !== 'unknown')
+    },
+  }
+  return { gate, batches }
+}
+
+describe('mustClassifyContent', () => {
+  it('refuses Chat with no gate before anything loads', () => {
+    expect(() => mustClassifyContent(CHAT)).toThrow(ContentDeliveryUnobservedError)
+  })
+
+  it('is true for Chat under a gate and false for every other caller, gate or not', () => {
+    const { gate } = recordingGate()
+    expect(observeContentDelivery(gate, () => mustClassifyContent(CHAT))).toBe(true)
+    expect(mustClassifyContent(EXECUTOR)).toBe(false)
+    expect(mustClassifyContent(SESSION)).toBe(false)
+    expect(observeContentDelivery(gate, () => mustClassifyContent(SESSION))).toBe(false)
+  })
+})
+
+describe('admitContent', () => {
+  it('decides each item on its own for Chat', async () => {
+    const { gate, batches } = recordingGate()
+    const items = [source('clean'), source('tainted', 'unknown'), source('also-clean')]
+    const admission = await observeContentDelivery(gate, () => admitContent(CHAT, items))
+    expect(items.map((item) => admission.admits(item))).toEqual([true, false, true])
+    expect(admission.refused.map((item) => item.id)).toEqual(['tainted'])
+    expect(batches).toEqual([['clean', 'tainted', 'also-clean']])
+  })
+
+  it('admits every other caller unread, whatever the items say', async () => {
+    const { gate, batches } = recordingGate()
+    const items = [source('tainted', 'unknown')]
+    for (const principal of [EXECUTOR, SESSION]) {
+      const admission = await observeContentDelivery(gate, () => admitContent(principal, items))
+      expect(admission.admits(items[0])).toBe(true)
+    }
+    expect(batches).toEqual([])
+  })
+
+  it('only accounts for an empty result, even for Chat with no gate', async () => {
+    const record = await trackContentDelivery(async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return admitContent(CHAT, [])
+    })
+    expect(record.result.refused).toEqual([])
+    expect(record.unaccounted).toBe(false)
+  })
+
+  it('refuses Chat items with no gate installed', async () => {
+    await expect(admitContent(CHAT, [source('clean')])).rejects.toThrow(
+      ContentDeliveryUnobservedError
+    )
+  })
+
+  it('refuses items classified inside an operation declared to return none', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(NONE, CHAT, () => admitContent(CHAT, [source('clean')]))
+      )
+    ).rejects.toMatchObject({ name: 'ContentDeliveryUndeclaredError' })
+  })
+})
+
+describe('requireAdmittedContent', () => {
+  it('passes an admitted item and refuses a refused one with a 403 naming no content', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () => requireAdmittedContent(CHAT, source('clean')))
+    ).resolves.toBeUndefined()
+    const refusal = await observeContentDelivery(gate, () =>
+      requireAdmittedContent(CHAT, source('tainted', 'unknown')).catch((error: unknown) => error)
+    )
+    expect(refusal).toBeInstanceOf(ContentRefusedError)
+    expect(refusal).toMatchObject({
+      code: 'forbidden',
+      message: expect.not.stringContaining('tainted'),
+    })
+  })
+})
+
+describe('runDeclaredContentOperation', () => {
+  it('throws for a sourced operation that never accounted, after its effects completed', async () => {
+    const { gate } = recordingGate()
+    const complete = vi.fn(async () => {})
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => 'unclassified', complete)
+      )
+    ).rejects.toThrow(ContentDeliveryUnaccountedError)
+    expect(complete).toHaveBeenCalledWith('unclassified')
+  })
+
+  it('returns a sourced result that accounted, and a none result that had nothing to account', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [source('clean')])
+          return 'classified'
+        })
+      )
+    ).resolves.toBe('classified')
+    await expect(runDeclaredContentOperation(NONE, CHAT, async () => 'metadata')).resolves.toBe(
+      'metadata'
+    )
+  })
+
+  it('runs every other caller unchanged, with no accounting demanded', async () => {
+    const complete = vi.fn(async () => {})
+    await expect(
+      runDeclaredContentOperation(SOURCED, EXECUTOR, async () => 'run output', complete)
+    ).resolves.toBe('run output')
+    expect(complete).toHaveBeenCalledWith('run output')
+  })
+
+  it('answers a committed write whose returned item was refused only after its effects', async () => {
+    const { gate } = recordingGate()
+    const events: string[] = []
+    const refusal = await observeContentDelivery(gate, () =>
+      runDeclaredContentOperation(
+        SOURCED,
+        CHAT,
+        async () => {
+          const admission = await admitWrittenContent(CHAT, [source('written', 'unknown')])
+          events.push(`write returned admitted=${admission.refused.length === 0}`)
+          return 'saved row'
+        },
+        async () => {
+          events.push('audit recorded')
+        }
+      ).catch((error: unknown) => error)
+    )
+    expect(events).toEqual(['write returned admitted=false', 'audit recorded'])
+    expect(refusal).toBeInstanceOf(ContentRefusedError)
+    expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
+  })
+
+  it('answers with a gate failure during a write only after its effects completed', async () => {
+    const failure = new Error('history unavailable')
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw failure
+      },
+    }
+    const events: string[] = []
+    const outcome = await observeContentDelivery(failing, () =>
+      runDeclaredContentOperation(
+        SOURCED,
+        CHAT,
+        async () => {
+          const admission = await admitWrittenContent(CHAT, [source('written')])
+          events.push(`withheld=${admission.refused.length}`)
+          return 'saved row'
+        },
+        async () => {
+          events.push('audit recorded')
+        }
+      ).catch((error: unknown) => error)
+    )
+    expect(events).toEqual(['withheld=1', 'audit recorded'])
+    expect(outcome).toBe(failure)
+  })
+
+  it('rethrows a gate failure at once when no operation is open to answer with it', async () => {
+    const failure = new Error('history unavailable')
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw failure
+      },
+    }
+    await expect(
+      observeContentDelivery(failing, () => admitWrittenContent(CHAT, [source('written')]))
+    ).rejects.toBe(failure)
+  })
+
+  it('lets a written result through when every returned item was admitted', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitWrittenContent(CHAT, [source('written')])
+          return 'saved row'
+        })
+      )
+    ).resolves.toBe('saved row')
+  })
+})
+
+describe('trackContentDelivery', () => {
+  it('reports a sourced operation Chat was admitted to whose use case never accounted', async () => {
+    const record = await trackContentDelivery(async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return 'response'
+    })
+    expect(record).toEqual({ result: 'response', unaccounted: true, admitted: [] })
+  })
+
+  it('does not report a none operation, or a sourced one another caller ran', async () => {
+    for (const [op, principal] of [
+      [NONE, CHAT],
+      [SOURCED, EXECUTOR],
+    ] as const) {
+      const record = await trackContentDelivery(async () => {
+        noteContentDeliveryOperation(op, principal)
+      })
+      expect(record.unaccounted).toBe(false)
+    }
+  })
+
+  it('collects the provenance of admitted items only, through nested use cases', async () => {
+    const { gate } = recordingGate()
+    const entries = {
+      status: 'exact' as const,
+      entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }],
+    }
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(() =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+            await admitContent(CHAT, [
+              { ...source('inner'), provenance: entries },
+              source('refused', 'unknown'),
+            ])
+          })
+          await admitContent(CHAT, [source('outer')])
+        })
+      )
+    )
+    expect(record.unaccounted).toBe(false)
+    expect(record.admitted).toEqual([entries, { status: 'exact', entries: [] }])
+  })
+
+  it('keeps a nested request’s accounting from satisfying a sibling that never accounted', async () => {
+    const { gate } = recordingGate()
+    const [accounted, unaccounted] = await observeContentDelivery(gate, () =>
+      Promise.all([
+        trackContentDelivery(async () => {
+          noteContentDeliveryOperation(SOURCED, CHAT)
+          await admitContent(CHAT, [source('clean')])
+        }),
+        trackContentDelivery(async () => {
+          noteContentDeliveryOperation(SOURCED, CHAT)
+        }),
+      ])
+    )
+    expect(accounted.unaccounted).toBe(false)
+    expect(unaccounted.unaccounted).toBe(true)
+  })
+})
+
+describe('observeContentDelivery', () => {
+  it('decides by the innermost gate', async () => {
+    const outer = recordingGate()
+    const inner = recordingGate()
+    await observeContentDelivery(outer.gate, () =>
+      observeContentDelivery(inner.gate, () => admitContent(CHAT, [source('clean')]))
+    )
+    expect(inner.batches).toEqual([['clean']])
+    expect(outer.batches).toEqual([])
+  })
+})
+
+describe('observeContentOutsideModel', () => {
+  it('admits every item, tainted ones included, inside a gate that would refuse them', async () => {
+    const { gate, batches } = recordingGate()
+    const tainted = source('tainted', 'unknown')
+    const admission = await observeContentDelivery(gate, () =>
+      observeContentOutsideModel(() => admitContent(CHAT, [tainted]))
+    )
+    expect(admission.admits(tainted)).toBe(true)
+    expect(batches).toEqual([])
+  })
+})
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
new file mode 100644
index 00000000000..3a0ed48e7d3
--- /dev/null
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -0,0 +1,392 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { Principal } from '@sim/auth/principal'
+import type { ApplicationOperation } from '@/lib/core/application/operation'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+
+/**
+ * The secret provenance of one stored item: `exact` names every secret its content can hold,
+ * `unrecorded` is a writer that recorded nothing (audited, otherwise ordinary input), and `unknown`
+ * is taint or a stale binding, which no policy relaxes.
+ */
+export type ContentProvenance = DurableSecretProvenance | { status: 'unrecorded' }
+
+export type ContentSourceKind =
+  | 'workspace-file'
+  | 'execution-file'
+  | 'knowledge-document'
+  | 'knowledge-chunk'
+  | 'table-row'
+
+/**
+ * How an item's content leaves the use case. `complete` is text in which any of its secrets may
+ * appear; `derived` is text built from part of it, so only secrets occurring in `value` count;
+ * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links.
+ */
+export type ContentView = 'complete' | 'opaque' | { derived: unknown }
+
+/** One stored item whose content, or content derived from it, a use case is about to return. */
+export interface ContentSource {
+  kind: ContentSourceKind
+  /** Canonical id, for attribution and per-item exclusion only. */
+  id: string
+  provenance: ContentProvenance
+  view: ContentView
+}
+
+/**
+ * Decides, per item, whether content may leave through the surface that installed it. A gate never
+ * throws for a refusal: refusing one item must not cost the call the items it admits.
+ */
+export interface ContentDeliveryGate {
+  admit(sources: readonly ContentSource[]): Promise<readonly boolean[]>
+}
+
+/**
+ * Whether a declared operation's result can carry content derived from a provenance-bearing store
+ * (workspace files and their versions, execution files, knowledge documents and chunks, table
+ * rows): bytes, text, excerpts, cells, previews, base64, archives, public links to such content, or
+ * a match oracle over it. `none` is spelled out, as `capability` is, so an operation Chat can reach
+ * cannot reach production without someone deciding.
+ */
+export type ContentDeliveryDeclaration = 'sourced' | 'none'
+
+/** Accounting for one dispatched request or one use-case execution. */
+interface ContentLedger {
+  parent?: ContentLedger
+  /** The declaration of the operation this ledger runs, when it runs one. */
+  declaration?: ContentDeliveryDeclaration
+  /** Chat was admitted to a `sourced` operation while this ledger was open. */
+  sourcedOperationAdmitted: boolean
+  /** A use case accounted for the sources it returns, even when it returned none. */
+  accounted: boolean
+  /** Provenance of every admitted item, for a surface that persists the delivered bytes. */
+  admitted: ContentProvenance[]
+  /** A committed write's returned item was refused; the operation answers with a refusal. */
+  withheldAfterWrite?: ContentSourceKind
+  /** A committed write's gate failed; the operation completes, then answers with this error. */
+  failedAfterWrite?: unknown
+  /** The gate itself failed while this ledger was open, whatever the route then answered. */
+  gateFailure?: unknown
+}
+
+const gates = new AsyncLocalStorage<ContentDeliveryGate>()
+const ledgers = new AsyncLocalStorage<ContentLedger>()
+
+const MODEL_UNSAFE_CONTENT_MESSAGES: Record<ContentSourceKind, string> = {
+  'workspace-file': 'File cannot be sent to a model because its secret provenance is unavailable',
+  'execution-file':
+    'Run file cannot be sent to a model because its secret provenance is unavailable',
+  'knowledge-document':
+    'Document cannot be sent to a model because its secret provenance is unavailable',
+  'knowledge-chunk': 'Chunk cannot be sent to a model because its secret provenance is unavailable',
+  'table-row': 'Row cannot be sent to a model because its secret provenance is unavailable',
+}
+
+/**
+ * A gate refused an item. A `403` like any refusal, but its own class, so a caller assembling many
+ * items can leave this one out without mistaking a permission denial for it.
+ */
+export class ContentRefusedError extends OrchestrationError {
+  /** `afterWrite` names a refusal of a write's returned content once the write has committed. */
+  constructor(kind: ContentSourceKind, options: { afterWrite?: boolean } = {}) {
+    super(
+      'forbidden',
+      options.afterWrite
+        ? `The change was saved. ${MODEL_UNSAFE_CONTENT_MESSAGES[kind]}, so the result is not shown; do not retry the change.`
+        : MODEL_UNSAFE_CONTENT_MESSAGES[kind]
+    )
+    this.name = 'ContentRefusedError'
+  }
+}
+
+/** Chat reached stored content with no gate to classify it. */
+export class ContentDeliveryUnobservedError extends Error {
+  constructor() {
+    super('Content provenance is unavailable for this read. Retry the read.')
+    this.name = 'ContentDeliveryUnobservedError'
+  }
+}
+
+/** A `sourced` operation completed for Chat without accounting for the content it returned. */
+export class ContentDeliveryUnaccountedError extends Error {
+  constructor(operationId: string) {
+    super(`Operation ${operationId} returned content to Chat without classifying it`)
+    this.name = 'ContentDeliveryUnaccountedError'
+  }
+}
+
+/** Content was classified for Chat inside an operation declared to return none. */
+class ContentDeliveryUndeclaredError extends Error {
+  constructor() {
+    super('Content was delivered to Chat by an operation declared to return none')
+    this.name = 'ContentDeliveryUndeclaredError'
+  }
+}
+
+/** Chat's own principals: the in-workspace delegation and the organization chat delegation. */
+export function isCopilotPrincipal(principal: Principal): boolean {
+  return (
+    (principal.kind === 'delegated' || principal.kind === 'organization_delegated') &&
+    principal.serviceId === 'copilot'
+  )
+}
+
+/** Installs the gate every item reported inside `execute` is decided by; the innermost gate wins. */
+export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: () => T): T {
+  return gates.run(gate, execute)
+}
+
+/** Admits every item: see {@link observeContentOutsideModel}. */
+const OUTSIDE_MODEL_GATE: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(() => true)
+  },
+}
+
+/**
+ * Reads, for Chat, content that never reaches its model: input to a stored artifact whose
+ * classification the caller derives from every source it read (a transcoded media file), or the
+ * user's own view of a file being edited. Items read inside `execute` are admitted unclassified,
+ * so a tainted source still yields a derived file that carries its taint. Each use names why.
+ */
+export function observeContentOutsideModel<T>(execute: () => T): T {
+  return gates.run(OUTSIDE_MODEL_GATE, execute)
+}
+
+/**
+ * Whether this call must classify what it returns: Chat's own principals, under the gate of the
+ * surface they read through. Chat with no gate is refused here, before anything loads, rather
+ * than handed content no surface classified. Use cases read provenance only when this is true, so
+ * a caller no gate observes — the UI, API keys, MCP, the executor, and app tools Chat runs under an
+ * executor identity, whose results carry their own provenance metadata — issues no extra query
+ * and sees no change.
+ */
+export function mustClassifyContent(principal: Principal): boolean {
+  if (!isCopilotPrincipal(principal)) return false
+  if (!gates.getStore()) throw new ContentDeliveryUnobservedError()
+  return true
+}
+
+/** The per-item verdicts for one call to {@link admitContent}. */
+export class ContentAdmission {
+  private readonly verdicts: ReadonlyMap<ContentSource, boolean>
+
+  constructor(sources: readonly ContentSource[], verdicts: readonly boolean[]) {
+    this.verdicts = new Map(sources.map((source, index) => [source, verdicts[index] === true]))
+  }
+
+  admits(source: ContentSource): boolean {
+    return this.verdicts.get(source) === true
+  }
+
+  get refused(): ContentSource[] {
+    return [...this.verdicts].filter(([, admitted]) => !admitted).map(([source]) => source)
+  }
+}
+
+function markAccounted(): void {
+  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) ledger.accounted = true
+}
+
+/**
+ * Classifies every item a use case is about to return, before its content loads. Call it once per
+ * result, with every contributing item, including an empty list: that call is the use case's
+ * promise to the operation's `sourced` declaration that nothing else in the result is sourced.
+ *
+ * Chat with no gate installed is refused (fail closed); every other caller is admitted unread. An
+ * empty list loads nothing, so it only accounts.
+ */
+export async function admitContent(
+  principal: Principal,
+  sources: readonly ContentSource[]
+): Promise<ContentAdmission> {
+  if (
+    sources.length > 0 &&
+    isCopilotPrincipal(principal) &&
+    ledgers.getStore()?.declaration === 'none'
+  ) {
+    throw new ContentDeliveryUndeclaredError()
+  }
+  markAccounted()
+  if (sources.length === 0 || !mustClassifyContent(principal)) {
+    return new ContentAdmission(
+      sources,
+      sources.map(() => true)
+    )
+  }
+  const gate = gates.getStore()
+  if (!gate) throw new ContentDeliveryUnobservedError()
+  const ledger = ledgers.getStore()
+  let verdicts: readonly boolean[]
+  try {
+    verdicts = await gate.admit(sources)
+  } catch (error) {
+    /** Kept for the transport: a route maps the error to its own response and hides the cause. */
+    for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
+      current.gateFailure ??= error
+    }
+    throw error
+  }
+  if (ledger) {
+    sources.forEach((source, index) => {
+      if (verdicts[index]) {
+        for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
+          current.admitted.push(source.provenance)
+        }
+      }
+    })
+  }
+  return new ContentAdmission(sources, verdicts)
+}
+
+/**
+ * Admits what a write returns after it committed. A refused item does not end the call here, so
+ * the operation still records its audit and signals its change; it then answers with a refusal
+ * naming the saved change instead of a result carrying content its gate refused.
+ */
+export async function admitWrittenContent(
+  principal: Principal,
+  sources: readonly ContentSource[]
+): Promise<ContentAdmission> {
+  let admission: ContentAdmission
+  try {
+    admission = await admitContent(principal, sources)
+  } catch (error) {
+    /**
+     * A gate that cannot decide (its record could not be written) must not undo the write's
+     * audit and effects either: every item is withheld, and the operation answers with the error.
+     */
+    const ledger = ledgers.getStore()
+    if (!ledger) throw error
+    for (let open: ContentLedger | undefined = ledger; open; open = open.parent) {
+      open.failedAfterWrite ??= error
+    }
+    return new ContentAdmission(
+      sources,
+      sources.map(() => false)
+    )
+  }
+  const refused = admission.refused[0]
+  if (refused) {
+    for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
+      ledger.withheldAfterWrite ??= refused.kind
+    }
+  }
+  return admission
+}
+
+/**
+ * Admits each of many items on its own and returns the admitted ones, in order. `classify` maps
+ * the items to their sources, one per item and batched; it runs only when this call must
+ * classify, so any other caller pays no provenance read. An item it cannot vouch for is `unknown`.
+ */
+export async function admitEach<T>(
+  principal: Principal,
+  items: readonly T[],
+  classify: (items: readonly T[]) => Promise<readonly ContentSource[]>,
+  options: { written?: boolean } = {}
+): Promise<T[]> {
+  if (items.length === 0 || !mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return [...items]
+  }
+  const sources = await classify(items)
+  const admission = await (options.written ? admitWrittenContent : admitContent)(principal, sources)
+  return items.filter((_, index) => admission.admits(sources[index]))
+}
+
+/**
+ * The single-item form: a refused item ends the call with a `403` before its content loads, with a
+ * constant message that names no content.
+ */
+export async function requireAdmittedContent(
+  principal: Principal,
+  source: ContentSource
+): Promise<void> {
+  const admission = await admitContent(principal, [source])
+  if (!admission.admits(source)) throw new ContentRefusedError(source.kind)
+}
+
+/** What one dispatched request delivered, as the transport that dispatched it needs to know. */
+export interface ContentDeliveryRecord<T> {
+  result: T
+  /** Chat ran a `sourced` operation whose use case never accounted for its content. */
+  unaccounted: boolean
+  /** The gate failed to decide during the request; see {@link ContentLedger.gateFailure}. */
+  gateFailure?: unknown
+  /** Provenance of every admitted item, in admission order. */
+  admitted: readonly ContentProvenance[]
+}
+
+/**
+ * Dispatches one request under its own ledger. A transport refuses a successful response whose
+ * record is `unaccounted`, whatever the HTTP method, so a route that forgot to classify its content
+ * fails closed instead of passing it through.
+ */
+export async function trackContentDelivery<T>(
+  execute: () => Promise<T>
+): Promise<ContentDeliveryRecord<T>> {
+  const ledger: ContentLedger = {
+    parent: ledgers.getStore(),
+    sourcedOperationAdmitted: false,
+    accounted: false,
+    admitted: [],
+  }
+  const result = await ledgers.run(ledger, execute)
+  return {
+    result,
+    unaccounted: ledger.sourcedOperationAdmitted && !ledger.accounted,
+    admitted: ledger.admitted,
+    ...(ledger.gateFailure === undefined ? {} : { gateFailure: ledger.gateFailure }),
+  }
+}
+
+/** Route admission records that Chat was admitted to an operation, in the request's ledger. */
+export function noteContentDeliveryOperation(
+  operation: ApplicationOperation,
+  principal: Principal
+): void {
+  if (!isCopilotPrincipal(principal) || operation.contentDelivery !== 'sourced') return
+  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
+    ledger.sourcedOperationAdmitted = true
+  }
+}
+
+/**
+ * Runs one use case for Chat under its operation's declaration: `execute` is the business phase,
+ * `complete` its audit and after-success effects. A `sourced` operation that returns without
+ * accounting throws rather than hand its content to a model unclassified, and one whose committed
+ * write returned refused content answers with that refusal once its effects are complete. This
+ * holds on every Chat path, transported or called in-process by a tool.
+ */
+export async function runDeclaredContentOperation<T>(
+  operation: ApplicationOperation,
+  principal: Principal,
+  execute: () => Promise<T>,
+  complete?: (result: T) => Promise<void>
+): Promise<T> {
+  if (!isCopilotPrincipal(principal)) {
+    const result = await execute()
+    await complete?.(result)
+    return result
+  }
+  noteContentDeliveryOperation(operation, principal)
+  const ledger: ContentLedger = {
+    parent: ledgers.getStore(),
+    declaration: operation.contentDelivery,
+    sourcedOperationAdmitted: false,
+    accounted: false,
+    admitted: [],
+  }
+  const result = await ledgers.run(ledger, execute)
+  await complete?.(result)
+  if (ledger.failedAfterWrite) throw ledger.failedAfterWrite
+  if (operation.contentDelivery === 'sourced' && !ledger.accounted) {
+    throw new ContentDeliveryUnaccountedError(operation.id)
+  }
+  if (ledger.withheldAfterWrite) {
+    throw new ContentRefusedError(ledger.withheldAfterWrite, { afterWrite: true })
+  }
+  return result
+}
diff --git a/apps/sim/lib/core/application/operation.ts b/apps/sim/lib/core/application/operation.ts
index ba2721ca1ae..a35b3522159 100644
--- a/apps/sim/lib/core/application/operation.ts
+++ b/apps/sim/lib/core/application/operation.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { OAuthApiScope } from '@/lib/auth/oauth-provider'
+import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
 import { requireOAuthOperationScope } from '@/lib/core/application/oauth-authorization'
 import type { OrchestrationRequestContext } from '@/lib/core/orchestration/types'
 import {
@@ -68,6 +69,12 @@ export interface ApplicationOperation<Id extends string = string> {
    * and `check:permission-group-enforcement` keeps reading the source.
    */
   readonly capability: OperationDeclarableCapability | 'none'
+  /**
+   * Whether the result can carry content derived from a provenance-bearing store. Required on
+   * every workspace operation Chat can reach (see {@link ContentDeliveryDeclaration}); a `sourced`
+   * operation's use case classifies each item through `admitContent` before returning it to Chat.
+   */
+  readonly contentDelivery?: ContentDeliveryDeclaration
 }
 
 export type OAuthOperationPolicy<Kinds extends readonly string[]> =
@@ -242,3 +249,27 @@ export interface OperationUseCase<O extends ApplicationOperation, I, R> {
     request?: OrchestrationRequestContext
   }): Promise<void>
 }
+
+/**
+ * An operation Chat can reach says whether it returns stored content; one it cannot reach says
+ * nothing, so the field always means a reviewed answer. Test fixtures escape type-checking, so
+ * this is enforced where operations are minted too.
+ */
+export function assertContentDeliveryDeclaration(
+  operation: ApplicationOperation,
+  delegatedServices: readonly string[]
+): void {
+  const admitsCopilot = delegatedServices.includes('copilot')
+  if (
+    admitsCopilot &&
+    operation.contentDelivery !== 'sourced' &&
+    operation.contentDelivery !== 'none'
+  ) {
+    throw new Error(
+      `Operation ${operation.id} admits Copilot but does not declare contentDelivery; name 'sourced' or 'none'`
+    )
+  }
+  if (!admitsCopilot && operation.contentDelivery !== undefined) {
+    throw new Error(`Operation ${operation.id} declares contentDelivery without admitting Copilot`)
+  }
+}
diff --git a/apps/sim/lib/core/application/organization-authorization.test.ts b/apps/sim/lib/core/application/organization-authorization.test.ts
index 019c963a649..4a727ea8763 100644
--- a/apps/sim/lib/core/application/organization-authorization.test.ts
+++ b/apps/sim/lib/core/application/organization-authorization.test.ts
@@ -21,6 +21,7 @@ const mocks = {
 const principal = createSessionPrincipal({ userId: 'member', sessionId: 'session' })
 const operation = defineOrganizationOperation({
   id: 'search.read',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
   oauthScope: 'api:read',
diff --git a/apps/sim/lib/core/application/organization-operation.ts b/apps/sim/lib/core/application/organization-operation.ts
index 8f2cb7695c6..b359f5fb192 100644
--- a/apps/sim/lib/core/application/organization-operation.ts
+++ b/apps/sim/lib/core/application/organization-operation.ts
@@ -1,6 +1,7 @@
 import type { OrganizationDelegatedPrincipal, Principal } from '@sim/auth/principal'
 import type { ApplicationOperation } from '@/lib/core/application/operation'
 import {
+  assertContentDeliveryDeclaration,
   assertOperationCapability,
   assertOperationOAuthPolicy,
 } from '@/lib/core/application/operation'
@@ -44,6 +45,7 @@ export function defineOrganizationOperation<const O extends OrganizationOperatio
   }
   if (operation.delegatedServices) Object.freeze(operation.delegatedServices)
   assertOperationOAuthPolicy(operation)
+  assertContentDeliveryDeclaration(operation, operation.delegatedServices ?? [])
   Object.freeze(operation.principalKinds)
   return Object.freeze(operation)
 }
diff --git a/apps/sim/lib/core/application/workspace-authorization.test.ts b/apps/sim/lib/core/application/workspace-authorization.test.ts
index a37da95e05b..0a906477d2e 100644
--- a/apps/sim/lib/core/application/workspace-authorization.test.ts
+++ b/apps/sim/lib/core/application/workspace-authorization.test.ts
@@ -262,6 +262,7 @@ const capabilityOperation = defineWorkspaceOperation({
 
 const copilotCapabilityOperation = defineWorkspaceOperation({
   id: 'test.copilot-capability-read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
diff --git a/apps/sim/lib/core/application/workspace-operation.test.ts b/apps/sim/lib/core/application/workspace-operation.test.ts
index c766eca2212..46a8e6733c8 100644
--- a/apps/sim/lib/core/application/workspace-operation.test.ts
+++ b/apps/sim/lib/core/application/workspace-operation.test.ts
@@ -6,6 +6,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
   it('preserves and freezes an explicit delegated service allowlist', () => {
     const operation = defineWorkspaceOperation({
       id: 'test.read',
+      contentDelivery: 'none',
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
@@ -33,6 +34,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
     expect(() =>
       defineWorkspaceOperation({
         id: 'test.unused_service_policy',
+        contentDelivery: 'none',
         minimumRole: 'read',
         workspaceApiKey: 'deny',
         principalKinds: ['session'],
@@ -46,6 +48,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
     expect(() =>
       defineWorkspaceOperation({
         id: 'test.duplicate_service_policy',
+        contentDelivery: 'none',
         minimumRole: 'read',
         workspaceApiKey: 'deny',
         principalKinds: ['delegated'],
diff --git a/apps/sim/lib/core/application/workspace-operation.ts b/apps/sim/lib/core/application/workspace-operation.ts
index 984bac44ddc..be368d787d7 100644
--- a/apps/sim/lib/core/application/workspace-operation.ts
+++ b/apps/sim/lib/core/application/workspace-operation.ts
@@ -1,11 +1,13 @@
 import type { DelegatedPrincipal, DelegatedServiceId, Principal } from '@sim/auth/principal'
 import type { PermissionType } from '@sim/platform-authz/workspace'
+import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
 import type {
   ApplicationOperation,
   OAuthOperationPolicy,
   PrincipalKind,
 } from '@/lib/core/application/operation'
 import {
+  assertContentDeliveryDeclaration,
   assertOperationCapability,
   assertOperationOAuthPolicy,
 } from '@/lib/core/application/operation'
@@ -69,6 +71,15 @@ type DelegatedPrincipalConsistency<
     }
   : { readonly delegatedServices?: never }
 
+/**
+ * Chat delivers whatever a Copilot-admitted operation returns to its model, so each one says
+ * whether that can be stored content; no other operation may claim to.
+ */
+type ContentDeliveryConsistency<DelegatedServices extends readonly DelegatedServiceId[]> =
+  'copilot' extends DelegatedServices[number]
+    ? { readonly contentDelivery: ContentDeliveryDeclaration }
+    : { readonly contentDelivery?: never }
+
 type ResourcePolicyOperationConsistency<Binding extends ResourcePolicyBinding | undefined> =
   Binding extends ResourcePolicyBinding
     ? { readonly resourcePolicy: Binding }
@@ -85,6 +96,7 @@ export function defineWorkspaceOperation<
     OAuthOperationPolicy<PrincipalKinds> &
     WorkspaceApiKeyPrincipalConsistency<Role, PrincipalKinds> &
     DelegatedPrincipalConsistency<PrincipalKinds, DelegatedServices> &
+    ContentDeliveryConsistency<DelegatedServices> &
     ResourcePolicyOperationConsistency<ResourcePolicy>
 ): WorkspaceOperation<Id, Role, PrincipalKinds, DelegatedServices> &
   OAuthOperationPolicy<PrincipalKinds> &
@@ -120,6 +132,8 @@ export function defineWorkspaceOperation<
 
   if (operation.resourcePolicy) requireResourcePolicyBinding(operation.resourcePolicy)
 
+  assertContentDeliveryDeclaration(operation, delegatedServices)
+
   /**
    * `capability` is required, so refusing an absent one reads as unreachable.
    * It is not. `apps/sim/tsconfig.json` excludes test files from type-checking,
diff --git a/apps/sim/lib/credential-groups/application/operations.ts b/apps/sim/lib/credential-groups/application/operations.ts
index c3c6e40c01b..a6db72f9f9e 100644
--- a/apps/sim/lib/credential-groups/application/operations.ts
+++ b/apps/sim/lib/credential-groups/application/operations.ts
@@ -12,6 +12,7 @@ export const credentialGroupOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/credential-groups/application/organization-access.ts b/apps/sim/lib/credential-groups/application/organization-access.ts
index f56e84e9952..f05d749ee24 100644
--- a/apps/sim/lib/credential-groups/application/organization-access.ts
+++ b/apps/sim/lib/credential-groups/application/organization-access.ts
@@ -27,6 +27,7 @@ import {
 export const organizationAccountAccessOperations = {
   read: defineOrganizationOperation({
     id: 'organization_accounts.workspace_access.read',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -35,6 +36,7 @@ export const organizationAccountAccessOperations = {
   }),
   update: defineOrganizationOperation({
     id: 'organization_accounts.workspace_access.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credential-groups/application/organization-account-management.ts b/apps/sim/lib/credential-groups/application/organization-account-management.ts
index a091e03c448..cb3ea051659 100644
--- a/apps/sim/lib/credential-groups/application/organization-account-management.ts
+++ b/apps/sim/lib/credential-groups/application/organization-account-management.ts
@@ -25,6 +25,7 @@ import { evictMcpServerConnections } from '@/lib/mcp/connection-pool'
 export const organizationAccountManagementOperations = {
   people: defineOrganizationOperation({
     id: 'organization_accounts.people.list',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -33,6 +34,7 @@ export const organizationAccountManagementOperations = {
   }),
   invite: defineOrganizationOperation({
     id: 'organization_accounts.people.invite',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -41,6 +43,7 @@ export const organizationAccountManagementOperations = {
   }),
   resend: defineOrganizationOperation({
     id: 'organization_accounts.people.resend',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -49,6 +52,7 @@ export const organizationAccountManagementOperations = {
   }),
   revoke: defineOrganizationOperation({
     id: 'organization_accounts.people.revoke',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -57,6 +61,7 @@ export const organizationAccountManagementOperations = {
   }),
   addMcp: defineOrganizationOperation({
     id: 'organization_accounts.mcp.add',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -65,6 +70,7 @@ export const organizationAccountManagementOperations = {
   }),
   removeMcp: defineOrganizationOperation({
     id: 'organization_accounts.mcp.remove',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credential-groups/application/organization-accounts.ts b/apps/sim/lib/credential-groups/application/organization-accounts.ts
index 3cfe7c5e6e0..5158f45ba45 100644
--- a/apps/sim/lib/credential-groups/application/organization-accounts.ts
+++ b/apps/sim/lib/credential-groups/application/organization-accounts.ts
@@ -52,6 +52,7 @@ import { isKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availab
 export const organizationAccountOperations = {
   read: defineOrganizationOperation({
     id: 'organization_accounts.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -60,6 +61,7 @@ export const organizationAccountOperations = {
   }),
   ensure: defineOrganizationOperation({
     id: 'organization_accounts.ensure',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -68,6 +70,7 @@ export const organizationAccountOperations = {
   }),
   update: defineOrganizationOperation({
     id: 'organization_accounts.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -76,6 +79,7 @@ export const organizationAccountOperations = {
   }),
   connect: defineOrganizationOperation({
     id: 'organization_accounts.connect',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credentials/application/operations.ts b/apps/sim/lib/credentials/application/operations.ts
index 566e5534e1e..b1bb906658b 100644
--- a/apps/sim/lib/credentials/application/operations.ts
+++ b/apps/sim/lib/credentials/application/operations.ts
@@ -44,6 +44,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'member'
@@ -61,6 +62,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   authorizePersonal: defineWorkspaceOperation({
@@ -69,6 +71,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   listInternal: defineWorkspaceOperation({
@@ -84,6 +87,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -99,6 +103,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -125,6 +130,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -133,6 +139,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -142,6 +149,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   read: defineCredentialOperation(
@@ -168,6 +176,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -179,6 +188,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -196,6 +206,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   upsertMember: defineCredentialOperation(
@@ -205,6 +216,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -216,6 +228,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -239,6 +252,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
     resourcePolicy: {
@@ -251,6 +265,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
     resourcePolicy: {
diff --git a/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts b/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
index 2fc9b72a254..124427d6104 100644
--- a/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
+++ b/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
@@ -23,6 +23,7 @@ import { livePolicyFor, loadLiveSearchPolicies } from '@/lib/sim-search/live/pol
 /** Search's organization delegation can use only the member's currently available personal grant. */
 export const organizationPersonalCredentialOperation = defineOrganizationOperation({
   id: 'credentials.organization.personal.use',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['organization_delegated'],
   delegatedServices: ['copilot'],
@@ -132,6 +133,7 @@ export const resolveOrganizationPersonalToken = {
 
 export const organizationPersonalConnectionOperation = defineOrganizationOperation({
   id: 'credentials.organization.personal.prepareConnection',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['organization_delegated'],
   delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/custom-tools/application/operations.ts b/apps/sim/lib/custom-tools/application/operations.ts
index d00ab6124bc..c6a238f0694 100644
--- a/apps/sim/lib/custom-tools/application/operations.ts
+++ b/apps/sim/lib/custom-tools/application/operations.ts
@@ -28,6 +28,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listAvailable: defineWorkspaceOperation({
@@ -36,6 +37,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -44,6 +46,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   readAvailableByIdOrTitle: defineWorkspaceOperation({
@@ -51,6 +54,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot', 'executor'],
   }),
@@ -60,6 +64,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -68,6 +73,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -76,6 +82,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/dashboards/application/availability.ts b/apps/sim/lib/dashboards/application/availability.ts
index 758dfeafbc9..d5ecc8008a3 100644
--- a/apps/sim/lib/dashboards/application/availability.ts
+++ b/apps/sim/lib/dashboards/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/dashboards/application/operations.ts b/apps/sim/lib/dashboards/application/operations.ts
index c66a54ccd43..d9d697e3acd 100644
--- a/apps/sim/lib/dashboards/application/operations.ts
+++ b/apps/sim/lib/dashboards/application/operations.ts
@@ -11,12 +11,14 @@ export const dashboardOperations = {
   read: defineWorkspaceOperation({
     ...policy,
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'dashboards.read',
     minimumRole: 'read',
   }),
   save: defineWorkspaceOperation({
     ...policy,
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'dashboards.save',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/data-drains/application/operations.ts b/apps/sim/lib/data-drains/application/operations.ts
index dd21c6c3848..4c5c62c2f5f 100644
--- a/apps/sim/lib/data-drains/application/operations.ts
+++ b/apps/sim/lib/data-drains/application/operations.ts
@@ -13,48 +13,56 @@ export const dataDrainOperations = Object.freeze({
   // permission-group-exempt: organization administrators govern organization-wide exports.
   list: defineOrganizationOperation({
     id: 'organization.data_drains.list',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   get: defineOrganizationOperation({
     id: 'organization.data_drains.get',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   create: defineOrganizationOperation({
     id: 'organization.data_drains.create',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   update: defineOrganizationOperation({
     id: 'organization.data_drains.update',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   delete: defineOrganizationOperation({
     id: 'organization.data_drains.delete',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   test: defineOrganizationOperation({
     id: 'organization.data_drains.test',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   run: defineOrganizationOperation({
     id: 'organization.data_drains.run',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   runs: defineOrganizationOperation({
     id: 'organization.data_drains.runs',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
diff --git a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
index 59d8ef72e4e..2894efbf826 100644
--- a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
@@ -35,6 +35,10 @@ export type DurableSecretProvenanceRefusalCause =
   | 'workspace-file-provenance-unavailable'
   | 'workspace-file-opaque-secret-content'
   | 'workspace-file-registry-unavailable'
+  | 'table-row-provenance-unavailable'
+  | 'table-row-opaque-secret-content'
+  | 'knowledge-opaque-secret-content'
+  | 'content-registry-unavailable'
 
 export interface DurableSecretProvenanceRefusalReport {
   surface: DurableSecretProvenanceSurface
diff --git a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
index 32277c4419b..31bfcad0b5b 100644
--- a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
+++ b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
@@ -34,6 +34,11 @@ export const workspaceFileBroker: SandboxBroker<WorkspaceFileArgs, WorkspaceFile
     if (!ctx.workspaceId) {
       throw new Error('workspaceFile broker requires a workspaceId')
     }
+    if (ctx.readableWorkspaceFileIds && !ctx.readableWorkspaceFileIds.has(args.fileId)) {
+      throw new Error(
+        `File ${args.fileId} is not readable here; reference input files by their literal id, e.g. getFileBase64("<file id>")`
+      )
+    }
 
     const record = await getWorkspaceFile(ctx.workspaceId, args.fileId)
     if (!record) {
diff --git a/apps/sim/lib/execution/sandbox/run-task.ts b/apps/sim/lib/execution/sandbox/run-task.ts
index d28d5175d54..fffca065871 100644
--- a/apps/sim/lib/execution/sandbox/run-task.ts
+++ b/apps/sim/lib/execution/sandbox/run-task.ts
@@ -20,6 +20,7 @@ export interface RunSandboxTaskOptions {
   signal?: AbortSignal
   /** Records canonical workspace files whose bytes were successfully read by a task broker. */
   onWorkspaceFileAccess?: SandboxBrokerContext['onWorkspaceFileAccess']
+  readableWorkspaceFileIds?: SandboxBrokerContext['readableWorkspaceFileIds']
   /** Run id that brokers see as `ctx.requestId`, for callers that keep per-run broker state. */
   requestId?: string
 }
@@ -59,6 +60,9 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
     workspaceId: input.workspaceId,
     requestId,
     onWorkspaceFileAccess: options.onWorkspaceFileAccess,
+    ...(options.readableWorkspaceFileIds
+      ? { readableWorkspaceFileIds: options.readableWorkspaceFileIds }
+      : {}),
   }
   const brokers: Record<string, IsolatedVMBrokerHandler> = {}
   for (const broker of task.brokers) {
diff --git a/apps/sim/lib/execution/sandbox/types.ts b/apps/sim/lib/execution/sandbox/types.ts
index ee7082ac094..eb2b93ef0c1 100644
--- a/apps/sim/lib/execution/sandbox/types.ts
+++ b/apps/sim/lib/execution/sandbox/types.ts
@@ -24,6 +24,11 @@ export interface SandboxBroker<TArgs = unknown, TResult = unknown> {
 export interface SandboxBrokerContext {
   workspaceId: string
   requestId: string
+  /**
+   * The only workspace files the broker may read, when set: each was admitted for the caller
+   * before the task ran, since the isolate's calls cannot be classified as they arrive.
+   */
+  readableWorkspaceFileIds?: ReadonlySet<string>
   onWorkspaceFileAccess?: (identity: {
     fileId: string
     key: string
diff --git a/apps/sim/lib/file-parsers/json-parser.test.ts b/apps/sim/lib/file-parsers/json-parser.test.ts
index 0a4d110e087..99b779d75f4 100644
--- a/apps/sim/lib/file-parsers/json-parser.test.ts
+++ b/apps/sim/lib/file-parsers/json-parser.test.ts
@@ -33,4 +33,29 @@ describe('JSON parser complexity limits', () => {
       code: 'invalid_format',
     })
   })
+
+  /**
+   * Text extraction errors reach Chat as the read's error, and egress redaction recognizes only
+   * whole secrets, so a message quoting a clipped excerpt of the file could carry part of one.
+   */
+  it.each([
+    [
+      'JSON',
+      parseJSONBuffer,
+      `{"config": {"key": sk_live_FIXTURE_0123456789abcdefghij${'x'.repeat(200)}}}`,
+    ],
+    [
+      'JSONL',
+      parseJSONLBuffer,
+      `{"ok": true}\n{"key": "${'x'.repeat(80)}sk_live_FIXTURE_0123456789abcdefghij`,
+    ],
+  ] as const)(
+    'names where invalid %s fails without quoting the file',
+    async (_kind, parse, text) => {
+      const error = await parse(Buffer.from(text)).catch((caught: unknown) => caught)
+      expect(error).toMatchObject({ code: 'invalid_format' })
+      expect(String((error as Error).message)).not.toContain('sk_l')
+      expect(String((error as Error).message)).not.toContain('xxxx')
+    }
+  )
 })
diff --git a/apps/sim/lib/file-parsers/json-parser.ts b/apps/sim/lib/file-parsers/json-parser.ts
index 562e4cbcd43..b8e9c236fe2 100644
--- a/apps/sim/lib/file-parsers/json-parser.ts
+++ b/apps/sim/lib/file-parsers/json-parser.ts
@@ -213,6 +213,18 @@ export function stripJsonComments(text: string): string {
   return out.replace(/,(\s*[}\]])/g, '$1')
 }
 
+/** V8's excerpt of the input: `Unexpected token 's', "…{"key": sk_l"... is not valid JSON`. */
+const QUOTED_INPUT_EXCERPT = /,\s*(?:\.\.\.)?".*"(?:\.\.\.)?\s+is not valid JSON$/s
+
+/**
+ * A parse failure's message without the clipped excerpt of the input V8 quotes in it. The message
+ * reaches Chat as the read's error, where redaction matches whole secrets only, so an excerpt cut
+ * through a secret would carry the part that survived the cut.
+ */
+function describeSyntaxError(error: unknown): string {
+  return getErrorMessage(error, 'Unknown error').replace(QUOTED_INPUT_EXCERPT, '')
+}
+
 function parseJsonContent(buffer: Uint8Array): FileParseResult {
   const decoded = decodeTextBuffer(buffer)
   try {
@@ -226,7 +238,7 @@ function parseJsonContent(buffer: Uint8Array): FileParseResult {
     if (lenient) return lenient
     throw new FileParserError(
       'invalid_format',
-      `Invalid JSON: ${getErrorMessage(error, 'Unknown error')}`,
+      `Invalid JSON: ${describeSyntaxError(error)}`,
       error
     )
   }
@@ -282,7 +294,7 @@ function parseJsonLinesContent(buffer: Uint8Array): FileParseResult {
     } catch (error) {
       throw new FileParserError(
         'invalid_format',
-        `Invalid JSONL on line ${lineNumber}: ${line.slice(0, 100)}`,
+        `Invalid JSONL on line ${lineNumber}: ${describeSyntaxError(error)}`,
         error
       )
     }
diff --git a/apps/sim/lib/function-execution/application/execute-chat-function.ts b/apps/sim/lib/function-execution/application/execute-chat-function.ts
index ed083afddc4..ec70b8bce40 100644
--- a/apps/sim/lib/function-execution/application/execute-chat-function.ts
+++ b/apps/sim/lib/function-execution/application/execute-chat-function.ts
@@ -21,11 +21,13 @@ export const executeChatFunction = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'function-executions.execute_chat',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/function-execution/application/operations.ts b/apps/sim/lib/function-execution/application/operations.ts
index bae1baceacd..e899d8913f2 100644
--- a/apps/sim/lib/function-execution/application/operations.ts
+++ b/apps/sim/lib/function-execution/application/operations.ts
@@ -7,6 +7,7 @@ export const functionExecutionOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
   }),
diff --git a/apps/sim/lib/invitations/application/list-workspace-invitations.ts b/apps/sim/lib/invitations/application/list-workspace-invitations.ts
index ad2b66a4c61..ffd094bb85e 100644
--- a/apps/sim/lib/invitations/application/list-workspace-invitations.ts
+++ b/apps/sim/lib/invitations/application/list-workspace-invitations.ts
@@ -8,6 +8,7 @@ export const listWorkspaceInvitationsOperation = defineWorkspaceOperation({
   id: 'workspace_invitations.list',
   minimumRole: 'admin',
   capability: 'none',
+  contentDelivery: 'none',
   workspaceApiKey: 'deny',
   principalKinds: ['session', 'delegated'],
   delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/manage-invitation.ts b/apps/sim/lib/invitations/application/manage-invitation.ts
index 20b37b67a8e..3c04ae48435 100644
--- a/apps/sim/lib/invitations/application/manage-invitation.ts
+++ b/apps/sim/lib/invitations/application/manage-invitation.ts
@@ -27,6 +27,7 @@ export const invitationManagementOperations = {
   /** permission-group-exempt: cancellation removes access and remains available when sends are withheld. */
   cancel: defineOrganizationOperation({
     id: 'organization_invitations.cancel',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'organization_delegated'],
@@ -36,6 +37,7 @@ export const invitationManagementOperations = {
   /** permission-group-exempt: resend checks invitations.send against each canonical admission and workspace scope below. */
   resend: defineOrganizationOperation({
     id: 'organization_invitations.resend',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'organization_delegated'],
@@ -256,6 +258,7 @@ export const workspaceInvitationManagementOperations = {
     id: 'workspace_invitations.cancel',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
@@ -264,6 +267,7 @@ export const workspaceInvitationManagementOperations = {
     id: 'workspace_invitations.resend',
     minimumRole: 'admin',
     capability: 'invitations.send',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/operations.ts b/apps/sim/lib/invitations/application/operations.ts
index 435e6474ba4..d72e3c74c41 100644
--- a/apps/sim/lib/invitations/application/operations.ts
+++ b/apps/sim/lib/invitations/application/operations.ts
@@ -60,6 +60,7 @@ export const workspaceInvitationOperations = {
     id: 'workspace_invitations.send_batch',
     minimumRole: 'admin',
     capability: 'invitations.send',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/send-invitation-batch.ts b/apps/sim/lib/invitations/application/send-invitation-batch.ts
index fde30ee9262..9e2d7ca5588 100644
--- a/apps/sim/lib/invitations/application/send-invitation-batch.ts
+++ b/apps/sim/lib/invitations/application/send-invitation-batch.ts
@@ -341,6 +341,7 @@ export const sendWorkspaceInvitationBatch = defineAuthorizedWorkspaceUseCase({
 
 const organizationInvitationSendOperation = defineOrganizationOperation({
   id: 'organization_invitations.send_batch',
+  contentDelivery: 'none',
   minimumRole: 'admin',
   capability: 'invitations.send',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
index 3f0fd094a10..c9f2e1f4cad 100644
--- a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
@@ -190,13 +190,26 @@ async function extract(ids: Fixture, archive: UserFile) {
   return { child, record, identity, publicMetadata: JSON.stringify({ archive, body }) }
 }
 
-async function assertBlockedConsumers(ids: Fixture, source: Awaited<ReturnType<typeof extract>>) {
+/**
+ * Opaque delivery is refused either way. A knowledge base refuses an unknown source but accepts
+ * one with recorded secrets, whose entries its chunks then carry (redacted wherever they are read).
+ */
+async function assertBlockedConsumers(
+  ids: Fixture,
+  source: Awaited<ReturnType<typeof extract>>,
+  knowledge: 'refused' | 'accepted' = 'refused'
+) {
   expect(await isOpaqueWorkspaceFileEgressSafe(ids.workspaceId, source.identity)).toBe(false)
   const imported = await addWorkspaceFilesToKnowledgeBase.execute({
     principal: sessionPrincipal(ids),
     input: { knowledgeBaseId: ids.knowledgeBaseId, fileReferences: [source.child.id] },
   })
-  expect(imported).toMatchObject({ added: [], failed: [source.child.id] })
+  if (knowledge === 'refused') {
+    expect(imported).toMatchObject({ added: [], failed: [source.child.id] })
+  } else {
+    expect(imported).toMatchObject({ failed: [] })
+    expect(imported.added).toHaveLength(1)
+  }
 }
 
 beforeAll(() => {
@@ -827,7 +840,7 @@ describe('execution archive durable provenance', () => {
     expect(projected.safe).toBe(true)
     if (!projected.safe) throw new Error('Known extracted lineage withheld runtime readback')
     expect(projected.value).toBe('name,description\nOrion,{{FIXTURE_SECRET}}\n')
-    await assertBlockedConsumers(ids, source)
+    await assertBlockedConsumers(ids, source, 'accepted')
   })
 
   it('preserves compatibility for execution files created before provenance stamping', async () => {
diff --git a/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
index 72b0687f2cb..d44f0fc0267 100644
--- a/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
@@ -101,7 +101,6 @@ async function readUpload(ids: Awaited<ReturnType<typeof seedUpload>>) {
       workspaceId: ids.workspaceId,
       chatId: ids.chatId,
       reference: `uploads/${ids.name}`,
-      includeSecretProvenance: true,
     },
   })
   return {
diff --git a/apps/sim/lib/knowledge/application/add-workspace-files.ts b/apps/sim/lib/knowledge/application/add-workspace-files.ts
index 241d463f469..36ac1b65c9a 100644
--- a/apps/sim/lib/knowledge/application/add-workspace-files.ts
+++ b/apps/sim/lib/knowledge/application/add-workspace-files.ts
@@ -37,6 +37,8 @@ import {
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
   getBoundWorkspaceFileSecretProvenance,
+  mergeWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenanceIdentity,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import {
@@ -81,7 +83,7 @@ interface AddWorkspaceFilesContext extends ActiveKnowledgeBaseContext {
 interface PreparedWorkspaceFile {
   reference: string
   file: WorkspaceFileRecord
-  unrecordedProvenance: boolean
+  provenance: WorkspaceFileSecretProvenance
 }
 
 async function prepareWorkspaceFile(
@@ -111,7 +113,7 @@ async function prepareWorkspaceFile(
   const fileTypeError = validateFileType(file.name, file.type)
   if (fileTypeError) throw new OrchestrationError('validation', fileTypeError.message)
 
-  const unrecordedProvenance = await assertImportProvenance(context.workspaceId, {
+  const provenance = await readImportProvenance(context.workspaceId, {
     fileId: file.id,
     key: file.key,
     context: file.storageContext ?? 'workspace',
@@ -121,25 +123,27 @@ async function prepareWorkspaceFile(
   return {
     reference,
     file,
-    unrecordedProvenance,
+    provenance,
   }
 }
 
-async function assertImportProvenance(
+/**
+ * The provenance a source file brings into the document. Its secret entries carry over to the
+ * document's content, and from there to each chunk that holds them, so reads redact them; only a
+ * source whose provenance is unknown is refused, since nothing could be carried for it.
+ */
+async function readImportProvenance(
   workspaceId: string,
   identity: WorkspaceFileSecretProvenanceIdentity
-): Promise<boolean> {
+): Promise<WorkspaceFileSecretProvenance> {
   const provenance = await getBoundWorkspaceFileSecretProvenance(workspaceId, identity)
-  if (
-    provenance.status === 'unknown' ||
-    (provenance.status === 'exact' && provenance.entries.length > 0)
-  ) {
+  if (provenance.status === 'unknown') {
     throw new OrchestrationError(
       'validation',
       'Workspace file secret provenance prevents knowledge ingestion'
     )
   }
-  return provenance.status === 'unrecorded'
+  return provenance
 }
 
 export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase({
@@ -221,7 +225,7 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         const requestId = generateRequestId()
         const current = await prepareWorkspaceFile(principal, context, candidate.file.id, 'id')
         const unrecordedSources = new Set<string>()
-        if (current.unrecordedProvenance) unrecordedSources.add(current.file.id)
+        const sourceProvenance: WorkspaceFileSecretProvenance[] = []
         const readSignal = AbortSignal.timeout(SOURCE_READ_TIMEOUT_MS)
         const signal = input.cancellationSignal
           ? AbortSignal.any([readSignal, input.cancellationSignal])
@@ -244,9 +248,9 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         }
         for (const identity of contributors) {
           signal.throwIfAborted()
-          if (await assertImportProvenance(context.workspaceId, identity)) {
-            unrecordedSources.add(identity.fileId)
-          }
+          const provenance = await readImportProvenance(context.workspaceId, identity)
+          if (provenance.status === 'unrecorded') unrecordedSources.add(identity.fileId)
+          sourceProvenance.push(provenance)
         }
         const documentId = generateId()
         const storedFile = await uploadKnowledgeArtifact({
@@ -274,7 +278,17 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         ) {
           throw new OrchestrationError('conflict', 'Workspace file changed during knowledge import')
         }
-        if (finalized.unrecordedProvenance) unrecordedSources.add(finalized.file.id)
+        if (finalized.provenance.status === 'unrecorded') unrecordedSources.add(finalized.file.id)
+        const content = mergeWorkspaceFileSecretProvenance(
+          finalized.provenance,
+          ...sourceProvenance
+        )
+        if (content.status === 'unknown') {
+          throw new OrchestrationError(
+            'validation',
+            'Workspace file secret provenance prevents knowledge ingestion'
+          )
+        }
         input.cancellationSignal?.throwIfAborted()
         const document = await createSingleDocument(
           {
@@ -289,7 +303,7 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
           documentId,
           {
             filename: { status: 'exact', entries: [] },
-            content: { status: 'exact', entries: [] },
+            content: content.status === 'exact' ? content : { status: 'exact', entries: [] },
             tags: [],
           },
           {
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
new file mode 100644
index 00000000000..8edfd31062b
--- /dev/null
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -0,0 +1,65 @@
+import type { Principal } from '@sim/auth/principal'
+import { admitEach } from '@/lib/core/application/content-delivery'
+import {
+  classifyKnowledgeChunks,
+  classifyKnowledgeDocumentMetadata,
+} from '@/lib/knowledge/secret-provenance'
+
+interface KnowledgeAdmissionOptions {
+  /** The items are what a committed write returns; see `admitWrittenContent`. */
+  written?: boolean
+}
+
+/**
+ * Admits each document whose rendered metadata a result returns, on its own, and returns the ids
+ * admitted. `value` is what the result shows of the document, so only secrets it contains are
+ * imported. A caller no gate observes gets every id back without a provenance read.
+ */
+export async function admitKnowledgeDocuments(
+  principal: Principal,
+  documents: readonly { id: string; value: unknown }[],
+  options: KnowledgeAdmissionOptions = {}
+): Promise<Set<string>> {
+  const admitted = await admitEach(
+    principal,
+    documents,
+    async (items) => {
+      const provenance = await classifyKnowledgeDocumentMetadata(items.map((item) => item.id))
+      return items.map((item) => ({
+        kind: 'knowledge-document' as const,
+        id: item.id,
+        provenance: provenance.get(item.id) ?? { status: 'unknown' as const },
+        view: { derived: item.value },
+      }))
+    },
+    options
+  )
+  return new Set(admitted.map((item) => item.id))
+}
+
+/**
+ * Admits each chunk a result returns, on its own: its content's provenance merged with that of the
+ * document whose metadata it carries. `value` is what the result shows of the chunk; without one,
+ * every secret the chunk and its document can hold counts. Returns the ids admitted.
+ */
+export async function admitKnowledgeChunks(
+  principal: Principal,
+  chunks: readonly { id: string; documentId: string; content: string; value?: unknown }[],
+  options: KnowledgeAdmissionOptions = {}
+): Promise<Set<string>> {
+  const admitted = await admitEach(
+    principal,
+    chunks,
+    async (items) => {
+      const provenance = await classifyKnowledgeChunks(items)
+      return items.map((chunk) => ({
+        kind: 'knowledge-chunk' as const,
+        id: chunk.id,
+        provenance: provenance.get(chunk.id) ?? { status: 'unknown' as const },
+        view: chunk.value === undefined ? ('complete' as const) : { derived: chunk.value },
+      }))
+    },
+    options
+  )
+  return new Set(admitted.map((chunk) => chunk.id))
+}
diff --git a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
index ef5c7b98d1f..b3893615b6e 100644
--- a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
+++ b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
@@ -7,6 +7,7 @@ import {
   requireAllowedWorkspacePrincipal,
   type WorkspaceUseCaseAuditEntry,
 } from '@/lib/core/application'
+import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import {
@@ -234,13 +235,18 @@ export function defineAuthorizedKnowledgeUseCase<
         context: resolved.context,
         request,
       }
-      return runWithOutboundOrganization(resolved.context.organizationId, async () => {
-        const result = await definition.execute(executionContext)
-        const resultContext = { ...executionContext, result }
-        recordOrganizationAudit(resultContext, resolved.context.organizationId)
-        await definition.afterSuccess?.(resultContext)
-        return result
-      })
+      return runWithOutboundOrganization(resolved.context.organizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          resolved.principal,
+          () => definition.execute(executionContext),
+          async (result) => {
+            const resultContext = { ...executionContext, result }
+            recordOrganizationAudit(resultContext, resolved.context.organizationId)
+            await definition.afterSuccess?.(resultContext)
+          }
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index fd2f5774014..9adef79d2d2 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
+import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -8,6 +9,7 @@ import {
   type DurableSecretProvenance,
 } from '@/lib/execution/durable-secret-provenance'
 import { reportDurableSecretProvenanceRefusal } from '@/lib/execution/durable-secret-provenance-telemetry'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveKnowledgeAttributedUserId } from '@/lib/knowledge/application/billing'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
@@ -65,6 +67,24 @@ export interface BulkKnowledgeChunksInput extends KnowledgeDocumentChunkInput {
   chunkIds: string[]
 }
 
+/**
+ * One chunk a result returns. A read is refused on its own when its gate refuses it; a committed
+ * write completes and then answers with the refusal (see `admitWrittenContent`).
+ */
+async function requireAdmittedChunk(
+  principal: Principal,
+  documentId: string,
+  chunk: { id: string; content: string },
+  options: { written?: boolean } = {}
+): Promise<void> {
+  const admitted = await admitKnowledgeChunks(
+    principal,
+    [{ id: chunk.id, documentId, content: chunk.content, value: chunk }],
+    options
+  )
+  if (!options.written && !admitted.has(chunk.id)) throw new ContentRefusedError('knowledge-chunk')
+}
+
 function requireChunkReadable(context: ActiveKnowledgeDocumentContext): void {
   if (context.document.processingStatus !== 'completed') {
     throw new KnowledgeDocumentNotReadyError(context.document.processingStatus)
@@ -112,7 +132,7 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ListKnowledgeChunksInput
   }) => resolveCanonicalActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     if (input.requireEnabledDocument && !context.document.enabled) {
       throw new OrchestrationError('not_found', 'Document not found')
     }
@@ -130,7 +150,21 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
       generateRequestId(),
       await context.access.get()
     )
-    return { ...result, workspaceId: context.workspaceId, documentId }
+    const admitted = await admitKnowledgeChunks(
+      principal,
+      result.chunks.map((chunk) => ({
+        id: chunk.id,
+        documentId,
+        content: chunk.content,
+        value: chunk,
+      }))
+    )
+    return {
+      ...result,
+      chunks: result.chunks.filter((chunk) => admitted.has(chunk.id)),
+      workspaceId: context.workspaceId,
+      documentId,
+    }
   },
 })
 
@@ -138,8 +172,9 @@ export const readKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readChunk,
   resolveContext: ({ principal, input }: { principal: Principal; input: KnowledgeChunkInput }) =>
     resolveActiveKnowledgeChunkContext(input, principal),
-  async execute({ context }) {
+  async execute({ principal, context }) {
     requireChunkReadable(context)
+    await requireAdmittedChunk(principal, context.documentId, context.chunk)
     return {
       chunk: context.chunk,
       workspaceId: context.workspaceId,
@@ -196,6 +231,7 @@ export const createKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
     } catch (error) {
       logger.warn('Failed to calculate cost for chunk upload', { error })
     }
+    await requireAdmittedChunk(principal, context.documentId, chunk, { written: true })
     return {
       chunk: {
         ...chunk,
@@ -259,6 +295,7 @@ export const updateKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
         provenance
       )
     )
+    await requireAdmittedChunk(principal, context.documentId, chunk, { written: true })
     return { chunk, workspaceId: context.workspaceId, documentId: context.documentId }
   },
 })
diff --git a/apps/sim/lib/knowledge/application/connectors.ts b/apps/sim/lib/knowledge/application/connectors.ts
index aee24d4ba78..79394fd9621 100644
--- a/apps/sim/lib/knowledge/application/connectors.ts
+++ b/apps/sim/lib/knowledge/application/connectors.ts
@@ -35,6 +35,7 @@ import { parseExactEnvironmentReference } from '@/lib/environment/reference'
 import { resolveEffectiveEnvironmentVariables } from '@/lib/environment/utils'
 import { requireKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availability'
 import { knowledgeAccessCondition } from '@/lib/knowledge/access/predicate'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   resolveKnowledgeAttributedUserId,
@@ -1190,7 +1191,7 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
     principal: Principal
     input: ListKnowledgeConnectorDocumentsInput
   }) => resolveActiveKnowledgeConnectorContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     const limit = input.limit ?? DEFAULT_KNOWLEDGE_CONNECTOR_DOCUMENT_PAGE_SIZE
     const offset = input.offset ?? 0
     if (
@@ -1260,9 +1261,13 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
         .offset(offset),
     ])
     const hasMore = rows.length > limit
-    const documents = rows.slice(0, limit)
+    const page = rows.slice(0, limit)
+    const admitted = await admitKnowledgeDocuments(
+      principal,
+      page.map((row) => ({ id: row.id, value: row }))
+    )
     return {
-      documents,
+      documents: page.filter((row) => admitted.has(row.id)),
       counts: {
         active: counts?.active ?? 0,
         excluded: counts?.excluded ?? 0,
diff --git a/apps/sim/lib/knowledge/application/documents.ts b/apps/sim/lib/knowledge/application/documents.ts
index 6a29c50085f..3b6123a1e49 100644
--- a/apps/sim/lib/knowledge/application/documents.ts
+++ b/apps/sim/lib/knowledge/application/documents.ts
@@ -9,8 +9,10 @@ import {
   checkAttributedUsageLimits,
 } from '@/lib/billing/core/billing-attribution'
 import { authorizeWorkspaceOperation } from '@/lib/core/application'
+import { admitContent, ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { knowledgeDelegationPolicy } from '@/lib/knowledge/application/authorization'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
@@ -257,6 +259,25 @@ export interface UpsertKnowledgeDocumentInput extends UploadKnowledgeDocumentAdm
  * so a presenter can key each document's tag values by display name — the same
  * projection knowledge search performs — without reading protected data itself.
  */
+/**
+ * One document a result returns. A read is refused on its own when its gate refuses its metadata;
+ * a committed write completes and then answers with the refusal (see `admitWrittenContent`).
+ */
+async function requireAdmittedDocument(
+  principal: Principal,
+  document: { id: string },
+  options: { written?: boolean } = {}
+): Promise<void> {
+  const admitted = await admitKnowledgeDocuments(
+    principal,
+    [{ id: document.id, value: document }],
+    options
+  )
+  if (!options.written && !admitted.has(document.id)) {
+    throw new ContentRefusedError('knowledge-document')
+  }
+}
+
 export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.listDocuments,
   resolveContext: ({
@@ -266,7 +287,7 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ListKnowledgeDocumentsInput
   }) => resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     const limit = input.limit ?? 50
     const offset = input.offset ?? 0
     if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
@@ -298,8 +319,13 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
       generateRequestId(),
       context.access
     )
+    const admitted = await admitKnowledgeDocuments(
+      principal,
+      result.documents.map((doc) => ({ id: doc.id, value: doc }))
+    )
     return {
       ...result,
+      documents: result.documents.filter((doc) => admitted.has(doc.id)),
       tagDefinitions:
         resolvedNameFilters?.definitionsByKnowledgeBase.get(context.knowledgeBaseId) ??
         (await getDocumentTagDefinitions(context.knowledgeBaseId)),
@@ -317,10 +343,11 @@ export const readKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ReadKnowledgeDocumentInput
   }) => resolveActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     if (input.requireEnabledDocument && !context.document.enabled) {
       throw new OrchestrationError('not_found', 'Document not found')
     }
+    await requireAdmittedDocument(principal, context.document)
     return {
       document: context.document,
       tagDefinitions: await getDocumentTagDefinitions(context.knowledgeBaseId),
@@ -828,6 +855,7 @@ export const updateKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
         }
         throw new OrchestrationError(outcome.errorCode, outcome.error)
       }
+      await admitContent(principal, [])
       return {
         kind: 'processing' as const,
         documentId: context.documentId,
@@ -853,9 +881,11 @@ export const updateKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     if (updatedFields.length === 0) {
       throw new OrchestrationError('validation', 'No updates specified')
     }
+    const document = await updateDocument(context.documentId, updates, generateRequestId())
+    await requireAdmittedDocument(principal, document, { written: true })
     return {
       kind: 'updated' as const,
-      document: await updateDocument(context.documentId, updates, generateRequestId()),
+      document,
       tagDefinitions: await getDocumentTagDefinitions(context.knowledgeBaseId),
       updatedFields,
     }
diff --git a/apps/sim/lib/knowledge/application/operations.ts b/apps/sim/lib/knowledge/application/operations.ts
index 28202ce3788..4286bf6a175 100644
--- a/apps/sim/lib/knowledge/application/operations.ts
+++ b/apps/sim/lib/knowledge/application/operations.ts
@@ -66,6 +66,8 @@ function defineKnowledgeOperation<const O extends WorkspaceOperation>(
           delegationAudience: options?.organizationDelegationAudience ?? 'sim:knowledge',
           delegatedServices:
             operation.id === 'knowledge.search' ? ['copilot', 'slack-search'] : ['copilot'],
+          /** Chat reaches the organization form through the same use case, under one declaration. */
+          contentDelivery: operation.contentDelivery ?? 'none',
         } as const)
       : ({ principalKinds: ['session', 'personal_api_key', 'oauth_access_token'] } as const)),
   })
@@ -94,6 +96,14 @@ const ALL_PRINCIPAL_WITH_EXECUTOR_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 
+/**
+ * Callers acting for themselves. A whole-base archive is opaque bytes no per-chunk secret
+ * redaction reaches, so Chat is not delegated to it; it reads a base chunk by chunk instead.
+ */
+const DIRECT_PRINCIPAL_POLICY = {
+  principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'workspace_api_key'],
+} as const
+
 const HUMAN_AND_DELEGATED_PRINCIPAL_KINDS = [
   'session',
   'personal_api_key',
@@ -275,6 +285,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -285,6 +296,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -300,7 +312,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.export',
-      ...ALL_PRINCIPAL_POLICY,
+      ...DIRECT_PRINCIPAL_POLICY,
     })
   ),
   /**
@@ -315,6 +327,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.create',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -325,6 +338,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -335,6 +349,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -352,6 +367,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -362,6 +378,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -372,6 +389,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -382,6 +400,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -392,6 +411,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -402,6 +422,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     }),
     /** Folder mentions resolve workspace folders; organization delegation stays disabled. */
@@ -414,6 +435,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -424,6 +446,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -434,6 +457,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -444,6 +468,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -454,6 +479,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -470,6 +496,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -480,6 +507,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -490,6 +518,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -500,6 +529,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -510,6 +540,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -520,6 +551,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -530,6 +562,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -540,6 +573,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -550,6 +584,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -560,6 +595,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -570,6 +606,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -586,6 +623,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -596,6 +634,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -606,6 +645,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -616,6 +656,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -626,6 +667,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -636,6 +678,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -646,6 +689,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -663,6 +707,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -674,6 +719,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -684,6 +730,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -694,6 +741,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -704,6 +752,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -714,6 +763,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -746,6 +796,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       principalKinds: ['session', 'delegated'],
       delegatedServices: ['copilot'],
     })
@@ -756,6 +807,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       principalKinds: ['session', 'delegated'],
       delegatedServices: ['copilot'],
     })
@@ -800,6 +852,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -820,6 +873,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -830,6 +884,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -840,6 +895,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -850,6 +906,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -866,6 +923,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -876,6 +934,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -886,6 +945,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -896,6 +956,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
diff --git a/apps/sim/lib/knowledge/application/read-original-document.test.ts b/apps/sim/lib/knowledge/application/read-original-document.test.ts
index 4ab20423c08..5fb3d83c914 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.test.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.test.ts
@@ -21,8 +21,15 @@ vi.mock('@/lib/knowledge/secret-provenance', () => ({
   loadKnowledgeDocumentDurableSecretProvenance: mocks.provenance,
 }))
 
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { readOriginalKnowledgeDocument } from '@/lib/knowledge/application/read-original-document'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 
 workspaceAuthzMockFns.mockPermissionSatisfies.mockImplementation(
   (actual: string | null) => actual !== null
@@ -54,6 +61,27 @@ const input = {
 }
 const run = () => readOriginalKnowledgeDocument.execute({ principal, input })
 
+/** A gate with no registry: it admits only items with no recorded secret. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+const runAsChat = () =>
+  observeContentDelivery(secretFreeGate, () =>
+    readOriginalKnowledgeDocument.execute({
+      principal: createCopilotChatPrincipal(
+        { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
+        KNOWLEDGE_DELEGATION_AUDIENCE
+      ),
+      input,
+    })
+  )
+
 describe('original knowledge document read', () => {
   beforeEach(() => {
     knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue(
@@ -113,21 +141,32 @@ describe('original knowledge document read', () => {
     ).rejects.toThrow(/limit/)
   })
   it.each([{ status: 'unknown' }, { status: 'exact', entries: [{ secret: 'private' }] }])(
-    'refuses originals without secret-free provenance',
+    'refuses Chat an original its gate refuses, before reading it: %j',
     async (provenance) => {
       mocks.provenance.mockResolvedValue({
         source: { filename: document.filename, fileUrl: document.fileUrl },
         provenance,
       })
-      await expect(run()).rejects.toThrow('secret-free')
+      await expect(runAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
       expect(storageServiceMockFns.mockDownloadFile).not.toHaveBeenCalled()
     }
   )
-  it('refuses a concurrent source replacement before reading', async () => {
+  it('serves Chat a secret-free original under its gate', async () => {
+    expect(await runAsChat()).toMatchObject({ sourceAvailable: true, hasRecordedSecrets: false })
+  })
+  it('classifies a concurrent source replacement as unknown, refusing it before reading', async () => {
     mocks.provenance.mockResolvedValue({
       source: { filename: 'changed', fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [] },
     })
-    await expect(run()).rejects.toThrow('secret-free')
+    await expect(runAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(storageServiceMockFns.mockDownloadFile).not.toHaveBeenCalled()
+  })
+  it('reads for a caller outside Chat without classifying, flagging recorded secrets', async () => {
+    mocks.provenance.mockResolvedValue({
+      source: { filename: document.filename, fileUrl: document.fileUrl },
+      provenance: { status: 'exact', entries: [{ secret: 'private' }] },
+    })
+    expect(await run()).toMatchObject({ sourceAvailable: true, hasRecordedSecrets: true })
   })
 })
diff --git a/apps/sim/lib/knowledge/application/read-original-document.ts b/apps/sim/lib/knowledge/application/read-original-document.ts
index 2af16362da2..96982d7a372 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.ts
@@ -1,4 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
+import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { hashDurableSecretProvenanceValue } from '@/lib/execution/durable-secret-provenance'
 import { decodeDataUriWithinLimit } from '@/lib/file-parsers/data-uri'
@@ -31,7 +32,7 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ReadOriginalKnowledgeDocumentInput
   }) => resolveCanonicalActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ input, context, principal }) {
     const maxBytes = input.maxBytes ?? MAX_TEXT_EXTRACTION_BYTES
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_TEXT_EXTRACTION_BYTES)
       throw new OrchestrationError('validation', 'Invalid document read byte limit')
@@ -45,23 +46,30 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
       processingStatus: doc.processingStatus,
       indexReady: doc.enabled && doc.processingStatus === 'completed',
     }
-    const unavailable = { ...metadata, sourceAvailable: false as const, buffer: undefined }
     if (doc.fileSize > maxBytes)
       throw new OrchestrationError(
         'payload_too_large',
         'Document exceeds the source read byte limit'
       )
     const snapshot = await loadKnowledgeDocumentDurableSecretProvenance(doc.id)
-    if (
-      hashDurableSecretProvenanceValue(snapshot.source) !==
-        hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc)) ||
-      snapshot.provenance.status !== 'exact' ||
-      snapshot.provenance.entries.length !== 0
-    ) {
-      throw new OrchestrationError(
-        'forbidden',
-        'This document has no verified secret-free original. Read its projected indexed passages instead.'
-      )
+    const provenance =
+      hashDurableSecretProvenanceValue(snapshot.source) ===
+      hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc))
+        ? snapshot.provenance
+        : ({ status: 'unknown' } as const)
+    await requireAdmittedContent(principal, {
+      kind: 'knowledge-document',
+      id: doc.id,
+      provenance,
+      view: 'complete',
+    })
+    /** A visual of these bytes would show what text redaction hides. */
+    const hasRecordedSecrets = provenance.status === 'exact' && provenance.entries.length > 0
+    const unavailable = {
+      ...metadata,
+      sourceAvailable: false as const,
+      buffer: undefined,
+      hasRecordedSecrets,
     }
     if (!doc.storageKey && !doc.fileUrl.startsWith('data:')) return unavailable
     let buffer: Buffer
@@ -84,6 +92,6 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
       throw error
     }
     input.signal?.throwIfAborted()
-    return { ...metadata, sourceAvailable: true as const, buffer }
+    return { ...metadata, sourceAvailable: true as const, buffer, hasRecordedSecrets }
   },
 })
diff --git a/apps/sim/lib/knowledge/application/search.ts b/apps/sim/lib/knowledge/application/search.ts
index 515b3f73826..9d5a3f0af9c 100644
--- a/apps/sim/lib/knowledge/application/search.ts
+++ b/apps/sim/lib/knowledge/application/search.ts
@@ -8,6 +8,7 @@ import {
 import { checkSearchUsageLimits } from '@/lib/billing/core/usage-gate-cache'
 import { recordUsage } from '@/lib/billing/core/usage-log'
 import { checkAndBillPayerOverageThreshold } from '@/lib/billing/threshold-billing'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeFromOwner, resourceScopeKey } from '@/lib/core/resource-scope'
 import { PlatformEvents } from '@/lib/core/telemetry'
@@ -17,6 +18,7 @@ import { reportDurableSecretProvenanceRefusal } from '@/lib/execution/durable-se
 import { requireOrganizationSearchAvailable } from '@/lib/knowledge/access/availability'
 import { createKnowledgeAccessProvider } from '@/lib/knowledge/access/scope'
 import type { KnowledgeAccessProvider } from '@/lib/knowledge/access/types'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   KnowledgeUsageLimitExceededError,
@@ -156,7 +158,7 @@ interface KnowledgeSearchCost {
   rerankerSearchUnits?: number
 }
 
-export interface SearchKnowledgeResult {
+interface SearchKnowledgeResult {
   retrieval: RetrievalStatus
   results: KnowledgeSearchItem[]
   query: string
@@ -480,7 +482,14 @@ export async function runKnowledgeSearch({
   })
   if (retrieved.retrieval.status === 'partial' && !input.allowPartialResults)
     throw new SearchDeadlineError()
-  let rows = retrieved.rows
+  input.signal?.throwIfAborted()
+  /**
+   * Chat sees each chunk only as its own gate admits it, before the reranker or the result: one
+   * chunk without provenance is left out instead of withholding the search. A result also renders
+   * its document's name and tags, so every secret the chunk and its document hold counts.
+   */
+  const admittedRows = await admitKnowledgeChunks(principal, retrieved.rows)
+  let rows = retrieved.rows.filter((row) => admittedRows.has(row.id))
   input.signal?.throwIfAborted()
   /** Public callers have no input envelope, but persisted reranker inputs still need provenance. */
   const registrySubjectUserId = resolvePrincipalSubjectUserId(principal)
@@ -806,7 +815,11 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.search,
   resolveContext: ({ principal, input }: { principal: Principal; input: SearchKnowledgeInput }) =>
     measureSearchStage('knowledge_context', () => resolveKnowledgeSearchContext(input, principal)),
-  execute: ({ principal, input, context }) => runKnowledgeSearch({ principal, input, context }),
+  async execute({ principal, input, context }) {
+    /** Accounted up front: a search that retrieves nothing returns no chunk to admit. */
+    await admitContent(principal, [])
+    return runKnowledgeSearch({ principal, input, context })
+  },
   afterSuccess: ({ principal, context, input, result }) =>
     afterKnowledgeSearch({ principal, context, input, result }),
 })
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index 9bf78e6f0e9..ca325c663c6 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -1,8 +1,10 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   resolveActiveKnowledgeResourceContext,
@@ -353,7 +355,9 @@ export const readKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
     resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ context }) {
+  async execute({ principal, context }) {
+    /** Counts per tag definition only; no tag value or document leaves. */
+    await admitContent(principal, [])
     return {
       usage: await getTagUsageStats(context.knowledgeBaseId, context.access, generateRequestId()),
     }
@@ -364,9 +368,19 @@ export const readDetailedKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readDetailedTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
     resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ context }) {
+  async execute({ principal, context }) {
+    const usage = await getTagUsage(context.knowledgeBaseId, generateRequestId(), context.access)
+    const admitted = await admitKnowledgeDocuments(
+      principal,
+      usage.flatMap((definition) => definition.documents.map((doc) => ({ id: doc.id, value: doc })))
+    )
     return {
-      usage: await getTagUsage(context.knowledgeBaseId, generateRequestId(), context.access),
+      usage: usage.map((definition) => {
+        const documents = definition.documents.filter((doc) => admitted.has(doc.id))
+        return documents.length === definition.documents.length
+          ? definition
+          : { ...definition, documents, documentCount: documents.length }
+      }),
     }
   },
 })
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index 3f73183cb46..7dff04b3001 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -439,6 +439,64 @@ export async function loadKnowledgeDocumentSecretRegistry(
   return { registry, provenance, tracked: true }
 }
 
+/**
+ * Classifies the rendered metadata (name, source URL, tags, typed fields) of each document, one
+ * statement for all of them. A document that is gone, or whose binding no longer matches its row,
+ * reads as unknown.
+ */
+export async function classifyKnowledgeDocumentMetadata(
+  documentIds: readonly string[]
+): Promise<Map<string, DurableSecretProvenance>> {
+  const ids = [...new Set(documentIds)]
+  const rows = ids.length
+    ? await selectKnowledgeDocumentProvenanceRows(inArray(document.id, ids))
+    : []
+  const result = new Map<string, DurableSecretProvenance>()
+  for (const row of rows) {
+    const source = createKnowledgeDocumentSourceValue(row)
+    result.set(
+      row.id,
+      filterKnowledgeDocumentMetadataSecretProvenance(
+        readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
+        source
+      )
+    )
+  }
+  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
+  return result
+}
+
+/**
+ * Classifies each chunk a result returns: its own content's binding, merged with the metadata of
+ * the document whose tags the chunk carries. A chunk whose row moved since it was read (other
+ * document, other content) reads as unknown. Two statements for any number of chunks.
+ */
+export async function classifyKnowledgeChunks(
+  chunks: readonly { id: string; documentId: string; content: string }[]
+): Promise<Map<string, DurableSecretProvenance>> {
+  const ids = [...new Set(chunks.map((chunk) => chunk.id))]
+  const [rows, documents] = await Promise.all([
+    ids.length ? selectKnowledgeEmbeddingProvenanceRows(inArray(embedding.id, ids)) : [],
+    classifyKnowledgeDocumentMetadata(chunks.map((chunk) => chunk.documentId)),
+  ])
+  const rowById = new Map(rows.map((row) => [row.id, row]))
+  return new Map(
+    chunks.map((chunk): [string, DurableSecretProvenance] => {
+      const row = rowById.get(chunk.id)
+      if (!row || row.documentId !== chunk.documentId || row.content !== chunk.content) {
+        return [chunk.id, { status: 'unknown' }]
+      }
+      return [
+        chunk.id,
+        mergeDurableSecretProvenance(
+          readBoundKnowledgeEmbeddingSecretProvenance(row),
+          documents.get(chunk.documentId) ?? { status: 'unknown' }
+        ),
+      ]
+    })
+  )
+}
+
 /** Loads the bound document classification for copy/re-entry callers that do not need a registry. */
 export async function loadKnowledgeDocumentDurableSecretProvenance(documentId: string): Promise<{
   source: KnowledgeDocumentSourceValue
diff --git a/apps/sim/lib/logs/application/operations.ts b/apps/sim/lib/logs/application/operations.ts
index 1f83b5f956f..1e67b4c8f06 100644
--- a/apps/sim/lib/logs/application/operations.ts
+++ b/apps/sim/lib/logs/application/operations.ts
@@ -24,6 +24,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...LOG_READER_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: aggregate run counts carry no execution payload, so there is nothing here for a group to withhold
@@ -33,6 +34,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -43,6 +45,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...LOG_READER_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the executor reading its own run's snapshot mid-flight; refusing it would fail runs the group permits
diff --git a/apps/sim/lib/mcp/application/operations.ts b/apps/sim/lib/mcp/application/operations.ts
index 1f38e05b576..1253fb734de 100644
--- a/apps/sim/lib/mcp/application/operations.ts
+++ b/apps/sim/lib/mcp/application/operations.ts
@@ -44,6 +44,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listManagedConnections: defineWorkspaceOperation({
@@ -59,6 +60,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...DISCOVERY_PRINCIPAL_POLICY,
   }),
   executeTool: defineWorkspaceOperation({
@@ -66,6 +68,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...EXECUTION_PRINCIPAL_POLICY,
   }),
   /**
@@ -90,6 +93,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -106,6 +110,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   listWorkflowDeploymentTools: defineWorkspaceOperation({
@@ -114,6 +119,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   createWorkflowDeploymentServer: defineWorkspaceOperation({
@@ -122,6 +128,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -143,6 +150,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   deleteWorkflowDeploymentServer: defineWorkspaceOperation({
@@ -151,6 +159,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   deployWorkflowTool: defineWorkspaceOperation({
@@ -159,6 +168,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   undeployWorkflowTool: defineWorkspaceOperation({
@@ -167,6 +177,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -175,6 +186,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -183,6 +195,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   register: defineWorkspaceOperation({
@@ -191,6 +204,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -199,6 +213,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   reconfigure: defineWorkspaceOperation({
@@ -207,6 +222,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   /** Pointing a server at another host or path; deployed workflows pin servers by id. */
@@ -216,6 +232,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -224,6 +241,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
index 5fd661f05b9..06cc2534864 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
@@ -6,9 +6,11 @@ import {
   document,
   embedding,
   embeddingSecretProvenance,
+  knowledgeConnector,
   organization,
   user,
   userTableRowSecretProvenance,
+  userTableRows,
   workflow,
   workflowExecutionLogs,
   workflowExecutionSnapshots,
@@ -42,7 +44,7 @@ export const CANARY = {
 } as const
 
 /** Classifications every content store is seeded with, one item each. */
-export type SeededClassification = 'clean' | 'entries' | 'unknown' | 'unrecorded'
+type SeededClassification = 'clean' | 'entries' | 'unknown' | 'unrecorded'
 
 export interface ContentFixture {
   ids: ReturnType<typeof createKnowledgeAclFixtureIds>
@@ -66,7 +68,7 @@ function sha256(value: string): string {
 }
 
 /** The text each seeded item holds: the canary its classification names, beside shared prose. */
-export function seededText(classification: SeededClassification): string {
+function seededText(classification: SeededClassification): string {
   switch (classification) {
     case 'clean':
       return `public notes ${CANARY.clean}\nsecond line`
@@ -233,10 +235,14 @@ async function seedTable(
     if (inserted.status !== 201) throw new Error(`Row fixture failed: ${await inserted.text()}`)
     rows[classification] = (await inserted.json()).data.id
   }
-  const columnEntries = (await exactEntries(fixture.ids)).map((entry) => ({
-    ...entry,
-    columnId: 'note',
-  }))
+  /** Cells are stored by column id; the sidecar names the one column the secret is in. */
+  const [stored] = await db
+    .select({ data: userTableRows.data })
+    .from(userTableRows)
+    .where(eq(userTableRows.id, rows.entries))
+  const [columnId] = Object.keys(stored?.data ?? {})
+  if (!columnId) throw new Error('Row fixture stored no cells')
+  const columnEntries = (await exactEntries(fixture.ids)).map((entry) => ({ ...entry, columnId }))
   /** v2 inserts already bind an exact-empty sidecar; only its classification is rewritten. */
   await db
     .update(userTableRowSecretProvenance)
@@ -339,3 +345,34 @@ export async function removeContentFixture(fixture: ContentFixture): Promise<voi
   await db.delete(organization).where(eq(organization.id, ids.organizationId))
   await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
 }
+
+/**
+ * Adds a document a connector synced, so a connector listing has a row to classify. Kept out of
+ * the shared seed, whose non-Chat responses the compat baseline records.
+ */
+export async function seedKnowledgeConnector(
+  fixture: ContentFixture
+): Promise<{ connectorId: string; documentId: string }> {
+  const connectorId = generateId()
+  await db.insert(knowledgeConnector).values({
+    id: connectorId,
+    knowledgeBaseId: fixture.knowledge.knowledgeBaseId,
+    connectorType: 'fixture',
+    sourceConfig: {},
+  })
+  const documentId = generateId()
+  await db.insert(document).values({
+    id: documentId,
+    knowledgeBaseId: fixture.knowledge.knowledgeBaseId,
+    connectorId,
+    filename: 'synced.txt',
+    fileUrl: `https://fixture.invalid/${documentId}`,
+    fileSize: 64,
+    mimeType: 'text/plain',
+    processingStatus: 'completed',
+    acl: ['ws'],
+    aclRequirements: [],
+    aclVerifiedAt: new Date(),
+  })
+  return { connectorId, documentId }
+}
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
new file mode 100644
index 00000000000..b6de3876fce
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -0,0 +1,661 @@
+/**
+ * Every Chat surface that can carry content from a provenance-bearing store, driven through the
+ * real composition: Chat's CLI transport and the run_code sandbox proxy, the real routes and use
+ * cases, real PostgreSQL and Redis. Each store holds one clean, one secret-bearing, one unknown and
+ * (for files) one unrecorded item, so every case shows the per-item decision side by side.
+ */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
+import { generateId } from '@sim/utils/id'
+import JSZip from 'jszip'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => {
+  if (process.env.TEST_REDIS_URL) process.env.REDIS_URL = process.env.TEST_REDIS_URL
+  return { root: '' }
+})
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+/** Admission throughput is not what this suite proves. */
+vi.mock('@/lib/core/rate-limiter', () => rateLimiterMock)
+vi.mock('@/lib/embeddings', async () => ({
+  ...(await import('@/lib/embeddings/client')),
+  assertKnowledgeEmbeddingCapacity: async () => {},
+  embedKnowledge: async (texts: string[]) => ({
+    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+    totalTokens: texts.length,
+    billableTokens: 0,
+    isBYOK: true,
+    modelName: 'text-embedding-3-small',
+    pricingId: 'text-embedding-3-small',
+  }),
+}))
+/** The remote workbench itself is a third-party machine; only its identity is needed here. */
+const workbench = vi.hoisted(() => ({ available: true }))
+vi.mock('@/lib/execution/remote-sandbox/provider', () => ({
+  resolveProvider: () => ({
+    id: 'e2b',
+    findSessionSandbox: async () => (workbench.available ? { sandboxId: 'fixture-sandbox' } : null),
+  }),
+}))
+/** The run lease that owns a sandbox token is the tool executor's concern, not this boundary's. */
+vi.mock('@/lib/mothership/async-runs/repository', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/mothership/async-runs/repository')>()),
+  isActiveSandboxResourceOwner: async () => true,
+}))
+
+import { db } from '@sim/db'
+import { copilotChats } from '@sim/db/schema'
+import { sha256Hex } from '@sim/security/hash'
+import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
+import { getRedisClient } from '@/lib/core/config/redis'
+import {
+  initializeSessionFileProvenance,
+  readSessionSecretProvenance,
+} from '@/lib/execution/remote-sandbox/session-file-provenance'
+import {
+  CANARY,
+  type ContentFixture,
+  ORIGIN,
+  removeContentFixture,
+  seedContentFixture,
+  seedKnowledgeConnector,
+} from '@/lib/mothership/__integration__/content-delivery-fixture'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const WORKBENCH = { providerId: 'e2b', sandboxId: 'fixture-sandbox' } as const
+
+interface ChatRead {
+  status: number
+  /** The body as text; a zip is flattened to `name: content` lines. */
+  body: string
+  registry: ResolvedSecretTraceRegistry
+}
+
+/** What Chat's model receives: the body projected through the call's registry, as egress does. */
+function modelView(read: ChatRead): string | undefined {
+  const projection = projectResolvedSecretModelContent(
+    read.body,
+    read.registry.forkForPropagatedEntries()
+  )
+  return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
+}
+
+async function bodyText(response: Response): Promise<string> {
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (!(response.headers.get('content-type') ?? '').includes('zip')) return bytes.toString('utf8')
+  const archive = await JSZip.loadAsync(bytes)
+  const lines: string[] = []
+  for (const name of Object.keys(archive.files).sort()) {
+    if (!archive.files[name].dir)
+      lines.push(`${name}: ${await archive.files[name].async('string')}`)
+  }
+  return lines.join('\n')
+}
+
+/**
+ * Routes Chat may call whose content is not driven through a transport here, each with the
+ * test that proves its gate instead. Running a workflow needs a deployed workflow and an executor;
+ * the inline file bytes it returns are withheld by the same helper the run read uses, proven here.
+ */
+const PROVEN_ELSEWHERE: Record<string, string> = {
+  'POST /api/v2/workflows/[workflowId]/execute':
+    'lib/workflows/application/admit-run-files.test.ts (withholdUnadmittedInlineFiles)',
+  'POST /api/v2/workflows/[workflowId]/runs/[runId]/resume':
+    'lib/workflows/application/admit-run-files.test.ts (withholdUnadmittedInlineFiles)',
+}
+
+/** Each content route a case drove, as `METHOD /api/v2/...` in the inventory's `[param]` form. */
+const exercised = new Set<string>()
+
+function noteExercised(method: string, route: string) {
+  const pathname = new URL(route, ORIGIN).pathname
+  const matched = matchV2Route(pathname)
+  if (matched) exercised.add(`${method} ${matched.pattern.replace(/\{([^}]+)\}/g, '[$1]')}`)
+}
+
+describe('content reaching Chat is admitted per item', () => {
+  let fixture: ContentFixture
+  let connector: { connectorId: string; documentId: string }
+
+  beforeAll(async () => {
+    fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-delivery-'))
+    fixture = await seedContentFixture()
+    connector = await seedKnowledgeConnector(fixture)
+  }, 120_000)
+
+  afterAll(async () => {
+    if (fixture) await removeContentFixture(fixture)
+    await rm(fixtureStorage.root, { recursive: true, force: true })
+  })
+
+  /** One Chat CLI request through the transport every CLI invocation and engine runs on. */
+  async function cli(method: string, route: string, body?: unknown): Promise<ChatRead> {
+    noteExercised(method, route)
+    const registry = new ResolvedSecretTraceRegistry([], {
+      userId: fixture.ids.aliceId,
+      workspaceId: fixture.ids.workspaceId,
+    })
+    const transport = createAgentCliTransport({
+      endpoint: ORIGIN,
+      invocation: {
+        userId: fixture.ids.aliceId,
+        workspaceId: fixture.ids.workspaceId,
+        chatId: generateId(),
+      },
+      registry,
+      resources: [],
+      observeReads: true,
+    })
+    const response = await withWorkspaceInvocationScope(
+      { workspaceId: fixture.ids.workspaceId, organizationId: fixture.ids.organizationId },
+      () =>
+        transport(`${ORIGIN}${route}`, {
+          method,
+          ...(body === undefined
+            ? {}
+            : { body: JSON.stringify(body), headers: { 'content-type': 'application/json' } }),
+        })
+    )
+    return { status: response.status, body: await bodyText(response), registry }
+  }
+
+  /** One request from run_code's workbench through the private sandbox proxy. */
+  async function sandbox(
+    method: string,
+    route: string,
+    body?: unknown
+  ): Promise<{ status: number; body: string; sessionKey: string }> {
+    noteExercised(method, route)
+    const token = generateId()
+    const apiKey = `sandbox-${generateId()}`
+    const chatId = generateId()
+    await db.insert(copilotChats).values({
+      id: chatId,
+      userId: fixture.ids.aliceId,
+      workspaceId: fixture.ids.workspaceId,
+      type: 'mothership',
+    })
+    await getRedisClient()?.set(
+      `mothership:sandbox-resources:${token}:context`,
+      JSON.stringify({
+        toolCallId: generateId(),
+        runId: generateId(),
+        userId: fixture.ids.aliceId,
+        ownerToken: generateId(),
+        chatId,
+        workspaceId: fixture.ids.workspaceId,
+        apiKeyHash: sha256Hex(apiKey),
+      }),
+      'EX',
+      600
+    )
+    const sessionKey = chatSandboxSessionKey(chatId)
+    /** A freshly created machine starts with clean history, as the sandbox session does. */
+    await initializeSessionFileProvenance(sessionKey, WORKBENCH)
+    const response = await proxySandboxResourceRequest(
+      new Request(`${ORIGIN}/api/mothership/sandbox/${token}${route}`, {
+        method,
+        headers: {
+          'x-api-key': apiKey,
+          ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      }),
+      token
+    )
+    return { status: response.status, body: await bodyText(response), sessionKey }
+  }
+
+  function workbenchHistory(sessionKey: string) {
+    return readSessionSecretProvenance(sessionKey, WORKBENCH)
+  }
+
+  const ws = () => fixture.ids.workspaceId
+  const kbPath = () => `/api/v2/knowledge/${fixture.knowledge.knowledgeBaseId}`
+  const chunksPath = () => `${kbPath()}/documents/${fixture.knowledge.documentId}/chunks`
+  const runPath = () => `/api/v2/workflows/${fixture.run.workflowId}/runs/${fixture.run.runId}`
+
+  /** Asserts the per-item outcome every collection case shares. */
+  function expectPerItem(read: ChatRead, options: { secretAdmitted: boolean }) {
+    expect(read.status).toBe(200)
+    expect(read.body).not.toContain(CANARY.unknown)
+    expect(read.body).toContain(CANARY.clean)
+    expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    const view = modelView(read)
+    expect(view).toBeDefined()
+    expect(view).toContain(CANARY.clean)
+    expect(view).not.toContain(CANARY.secret)
+    if (options.secretAdmitted) expect(read.body).toContain(CANARY.secret)
+    else expect(read.body).not.toContain(CANARY.secret)
+  }
+
+  describe('Chat CLI', () => {
+    it('zips only admitted files into a bulk download (P1/P2, #4)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${Object.values(fixture.files)}`
+      )
+      expectPerItem(read, { secretAdmitted: false })
+      expect(read.body).toContain(CANARY.unrecorded)
+    })
+
+    it('answers files search, dropping lines from refused files (#5, misroute)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
+      )
+      expect(read.status).toBe(200)
+      const results: Array<{ fileId: string; text: string }> = JSON.parse(read.body).data.results
+      const files = new Set(results.map((result) => result.fileId))
+      expect(files.has(fixture.files.clean)).toBe(true)
+      expect(files.has(fixture.files.unrecorded)).toBe(true)
+      expect(files.has(fixture.files.unknown)).toBe(false)
+      expect(read.body).not.toContain(CANARY.unknown)
+      expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('refuses an unknown run file and redacts a secret-bearing one (#7)', async () => {
+      const unknown = await cli('GET', `${runPath()}/files/${fixture.run.files.unknown}`)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(false)
+
+      const entries = await cli('GET', `${runPath()}/files/${fixture.run.files.entries}`)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      const clean = await cli('GET', `${runPath()}/files/${fixture.run.files.clean}`)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+    })
+
+    it('inlines only clean run files as base64 (#8)', async () => {
+      const read = await cli('GET', `${runPath()}?includeOutput=true&includeFileBase64=true`)
+      expect(read.status).toBe(200)
+      const files: Array<{ id: string; base64: string | null }> = JSON.parse(read.body).data.files
+      const byId = new Map(files.map((file) => [file.id, file.base64]))
+      expect(byId.get(fixture.run.files.clean)).toBeTruthy()
+      expect(byId.get(fixture.run.files.unknown)).toBeNull()
+      expect(byId.get(fixture.run.files.entries)).toBeNull()
+      expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('lists only admitted knowledge chunks and refuses an unknown one (#10)', async () => {
+      const list = await cli('GET', `${chunksPath()}?workspaceId=${ws()}`)
+      expectPerItem(list, { secretAdmitted: true })
+
+      const unknown = await cli(
+        'GET',
+        `${chunksPath()}/${fixture.knowledge.chunks.unknown}?workspaceId=${ws()}`
+      )
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('searches knowledge per chunk instead of withholding the whole search (#11, O5)', async () => {
+      const read = await cli('POST', '/api/v2/knowledge/search', {
+        workspaceId: ws(),
+        knowledgeBaseIds: [fixture.knowledge.knowledgeBaseId],
+        query: 'second line',
+      })
+      expectPerItem(read, { secretAdmitted: true })
+    })
+
+    it('does not admit Chat to a whole knowledge base export (#12)', async () => {
+      const read = await cli('GET', `${kbPath()}/export?workspaceId=${ws()}`)
+      expect(read.status).toBe(403)
+      expect(read.body).not.toContain(CANARY.unknown)
+    })
+
+    it('returns table rows per row instead of withholding the page (#18, O5)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expectPerItem(read, { secretAdmitted: true })
+    })
+
+    it('drops row-search matches that would probe unadmitted cells (#18b)', async () => {
+      const read = await cli('POST', `/api/v2/tables/${fixture.table.tableId}/rows/search`, {
+        workspaceId: ws(),
+        q: 'second',
+      })
+      expect(read.status).toBe(200)
+      const rows = new Set(
+        JSON.parse(read.body).data.matches.map((match: { rowId: string }) => match.rowId)
+      )
+      expect(rows).toEqual(new Set([fixture.table.rows.clean]))
+    })
+
+    it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {
+      const share = (fileId: string) =>
+        cli('PATCH', `/api/v2/files/${fileId}/share`, {
+          workspaceId: ws(),
+          isActive: true,
+          authType: 'public',
+        })
+      expect((await share(fixture.files.unknown)).status).toBe(403)
+      expect((await share(fixture.files.entries)).status).toBe(403)
+      expect((await share(fixture.files.clean)).status).toBe(200)
+    })
+    it('reads one file directly: clean as is, secrets redacted, unknown withheld whole (#1, D7)', async () => {
+      const download = (fileId: string) => cli('GET', `/api/v2/files/${fileId}?workspaceId=${ws()}`)
+      const clean = await download(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const entries = await download(fixture.files.entries)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).toBeDefined()
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      /** The single-file exception: delivered for the workbench, never shown to the model. */
+      const unknown = await download(fixture.files.unknown)
+      expect(unknown.status).toBe(200)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(true)
+      expect(modelView(unknown)).toBeUndefined()
+    })
+
+    it('reads file text per file and refuses unknown text (#2)', async () => {
+      const text = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/text?workspaceId=${ws()}`)
+      const clean = await text(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const entries = await text(fixture.files.entries)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      const unknown = await text(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('reads a historical version as text under its own classification (#3)', async () => {
+      const version = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/versions/1/text?workspaceId=${ws()}`)
+      const clean = await version(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const unknown = await version(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('refuses an edit whose search would probe unknown text, and edits a clean file (#22)', async () => {
+      const edit = (fileId: string) =>
+        cli('PATCH', `/api/v2/files/${fileId}/content`, {
+          workspaceId: ws(),
+          edit: { mode: 'search_replace', search: 'tainted', content: 'probed' },
+        })
+      const unknown = await edit(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+
+      const scratch = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from('scratch notes tainted once'),
+        `scratch-${generateId()}.txt`,
+        'text/plain',
+        { secretProvenance: { status: 'exact', entries: [] }, notifyWorkspaceChange: false }
+      )
+      expect((await edit(scratch.id)).status).toBe(200)
+    })
+
+    it('replaces a file’s content without reading what it held (#22)', async () => {
+      const scratch = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`replaced ${CANARY.unknown}`),
+        `replace-${generateId()}.txt`,
+        'text/plain',
+        { secretProvenance: { status: 'unknown' }, notifyWorkspaceChange: false }
+      )
+      const write = await cli('PUT', `/api/v2/files/${scratch.id}/content`, {
+        workspaceId: ws(),
+        content: 'fresh content',
+      })
+      expect(write.status).toBe(200)
+      expect(write.body).not.toContain(CANARY.unknown)
+    })
+
+    it('reads a share’s state only for a file Chat could share (#9)', async () => {
+      const read = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/share?workspaceId=${ws()}`)
+      expect((await read(fixture.files.clean)).status).toBe(200)
+      const unknown = await read(fixture.files.unknown)
+      /** An unshared file's share state names no content, so it reads like any other. */
+      expect(unknown.status).toBe(200)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('lists, reads and updates knowledge documents by their own metadata (#13)', async () => {
+      const list = await cli('GET', `${kbPath()}/documents?workspaceId=${ws()}`)
+      expect(list.status).toBe(200)
+      expect(list.body).toContain(fixture.knowledge.documentId)
+
+      const synced = await cli(
+        'GET',
+        `${kbPath()}/connectors/${connector.connectorId}/documents?workspaceId=${ws()}`
+      )
+      expect(synced.status).toBe(200)
+      expect(synced.body).toContain(connector.documentId)
+
+      const read = await cli(
+        'GET',
+        `${kbPath()}/documents/${fixture.knowledge.documentId}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(200)
+      expect(read.body).not.toContain(CANARY.unknown)
+
+      const update = await cli('PATCH', `${kbPath()}/documents/${fixture.knowledge.documentId}`, {
+        workspaceId: ws(),
+        enabled: true,
+      })
+      expect(update.status).toBe(200)
+      expect(update.body).not.toContain(CANARY.unknown)
+
+      const usage = await cli('GET', `${kbPath()}/tags/usage?workspaceId=${ws()}`)
+      expect(usage.status).toBe(200)
+      expect(usage.body).not.toContain(CANARY.unknown)
+    })
+
+    it('creates and updates chunks without echoing unknown content (#10)', async () => {
+      const created = await cli('POST', chunksPath(), {
+        workspaceId: ws(),
+        content: 'chat wrote this chunk',
+      })
+      expect(created.status).toBe(201)
+      expect(modelView(created)).toContain('chat wrote this chunk')
+
+      const updated = await cli('PATCH', `${chunksPath()}/${fixture.knowledge.chunks.unknown}`, {
+        workspaceId: ws(),
+        enabled: true,
+      })
+      /** The toggle commits and is audited; the chunk it would echo stays unknown, so is refused. */
+      expect(updated.status).toBe(403)
+      expect(updated.body).not.toContain(CANARY.unknown)
+    })
+
+    it('queries, counts and reads table rows per row (#18)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const query = await cli('POST', `${table}/query`, { workspaceId: ws() })
+      expectPerItem(query, { secretAdmitted: true })
+
+      const count = await cli('POST', `${table}/query/count`, { workspaceId: ws() })
+      expect(count.status).toBe(200)
+
+      const clean = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.clean}?workspaceId=${ws()}`
+      )
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const unknown = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.unknown}?workspaceId=${ws()}`
+      )
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+
+      const enrichment = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.unknown}/enrichment/${generateId()}?workspaceId=${ws()}`
+      )
+      expect(enrichment.status).toBe(404)
+      expect(enrichment.body).not.toContain(CANARY.unknown)
+    })
+
+    it('writes rows and returns only what a write may show (#18)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const created = await cli('POST', `${table}/rows`, {
+        workspaceId: ws(),
+        data: { note: 'chat row' },
+      })
+      expect(created.status).toBe(201)
+      expect(modelView(created)).toContain('chat row')
+
+      const updated = await cli('PATCH', `${table}/rows/${fixture.table.rows.unknown}`, {
+        workspaceId: ws(),
+        data: { note: 'overwritten by chat' },
+      })
+      /** A row once unknown stays unknown after a partial write, so the echo is refused. */
+      expect(updated.status).toBe(403)
+      expect(updated.body).not.toContain(CANARY.unknown)
+
+      const keyed = await cli('POST', '/api/v2/tables', {
+        workspaceId: ws(),
+        name: `keyed_${generateId().slice(0, 8)}`,
+        schema: { columns: [{ name: 'key', type: 'string', unique: true }] },
+      })
+      expect(keyed.status).toBe(201)
+      const keyedId: string = JSON.parse(keyed.body).data.id
+      const upsert = () =>
+        cli('POST', `/api/v2/tables/${keyedId}/rows/upsert`, {
+          workspaceId: ws(),
+          data: { key: 'chat-upserted' },
+        })
+      for (const write of [await upsert(), await upsert()]) {
+        expect(write.status).toBe(200)
+        expect(modelView(write)).toContain('chat-upserted')
+      }
+    })
+  })
+
+  describe('run_code sandbox proxy', () => {
+    it('refuses an unknown file read without tainting the workbench (O1)', async () => {
+      const read = await sandbox(
+        'GET',
+        `/api/v2/files/${fixture.files.unknown}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(403)
+      expect(read.body).not.toContain(CANARY.unknown)
+      expect(await workbenchHistory(read.sessionKey)).toEqual({ status: 'exact', entries: [] })
+    })
+
+    it('records the entries of a secret-bearing read in the workbench history', async () => {
+      const read = await sandbox(
+        'GET',
+        `/api/v2/files/${fixture.files.entries}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(200)
+      const history = await workbenchHistory(read.sessionKey)
+      expect(history.status).toBe('exact')
+      expect(history.status === 'exact' && history.entries.length).toBe(1)
+    })
+
+    it('zips and searches only admitted files (P1)', async () => {
+      const zip = await sandbox(
+        'GET',
+        `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${Object.values(fixture.files)}`
+      )
+      expect(zip.status).toBe(200)
+      expect(zip.body).toContain(CANARY.clean)
+      expect(zip.body).not.toContain(CANARY.unknown)
+
+      const search = await sandbox(
+        'GET',
+        `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
+      )
+      expect(search.status).toBe(200)
+      expect(search.body).not.toContain(fixture.files.unknown)
+      expect((await workbenchHistory(search.sessionKey)).status).toBe('exact')
+    })
+
+    it('refuses table export download links and unknown run files (#17, #7)', async () => {
+      const exportLink = await sandbox(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/exports/${generateId()}/download?workspaceId=${ws()}`
+      )
+      expect(exportLink.status).toBe(403)
+
+      const runFile = await sandbox('GET', `${runPath()}/files/${fixture.run.files.unknown}`)
+      expect(runFile.status).toBe(403)
+      expect(runFile.body).not.toContain(CANARY.unknown)
+    })
+
+    it('completes a write whose result cannot be recorded, then withholds it (502)', async () => {
+      const note = `committed ${generateId()}`
+      workbench.available = false
+      let write: Awaited<ReturnType<typeof sandbox>>
+      try {
+        write = await sandbox('POST', `/api/v2/tables/${fixture.table.tableId}/rows`, {
+          workspaceId: ws(),
+          data: { note },
+        })
+      } finally {
+        workbench.available = true
+      }
+      expect(write.status).toBe(502)
+      expect(write.body).not.toContain(note)
+      expect(write.body).toContain('Do not retry a mutation automatically')
+      const rows = await cli(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expect(rows.body).toContain(note)
+    })
+
+    it('excludes unknown knowledge chunks and table rows (#10, #18)', async () => {
+      const chunks = await sandbox('GET', `${chunksPath()}?workspaceId=${ws()}`)
+      expect(chunks.status).toBe(200)
+      expect(chunks.body).toContain(CANARY.clean)
+      expect(chunks.body).not.toContain(CANARY.unknown)
+
+      const rows = await sandbox(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expect(rows.status).toBe(200)
+      expect(rows.body).toContain(CANARY.clean)
+      expect(rows.body).not.toContain(CANARY.unknown)
+      expect((await workbenchHistory(rows.sessionKey)).status).toBe('exact')
+    })
+  })
+
+  it('drives every content route Chat may call, or names the test that proves it', () => {
+    const missing = contentRoutes
+      .map((route) => `${route.method} ${route.path}`)
+      .filter((key) => !exercised.has(key) && !PROVEN_ELSEWHERE[key])
+    expect(missing).toEqual([])
+  })
+})
diff --git a/apps/sim/lib/mothership/agent-cli/engines/file-read.ts b/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
index da8cf096a34..3357e3d8d00 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
@@ -54,16 +54,17 @@ export const fileReadCommand: AgentCliEngine = {
         if (!match) return agentCliFail('Use knowledge/<knowledgeBaseId>/<documentId>.')
         const principal = enginePrincipal(runtime, readOriginalKnowledgeDocument)
         if (!principal) return agentCliFail('Knowledge authentication is unavailable.')
-        const { buffer, ...metadata } = await readOriginalKnowledgeDocument.execute({
-          principal,
-          input: {
-            knowledgeBaseId: match[1],
-            documentId: match[2],
-            assertedWorkspaceId: runtime.workspaceId,
-            maxBytes: query.data.maxBytes,
-            signal: runtime.signal,
-          },
-        })
+        const { buffer, hasRecordedSecrets, ...metadata } =
+          await readOriginalKnowledgeDocument.execute({
+            principal,
+            input: {
+              knowledgeBaseId: match[1],
+              documentId: match[2],
+              assertedWorkspaceId: runtime.workspaceId,
+              maxBytes: query.data.maxBytes,
+              signal: runtime.signal,
+            },
+          })
         if (!buffer)
           return agentCliOk(
             JSON.stringify({
@@ -74,7 +75,14 @@ export const fileReadCommand: AgentCliEngine = {
             })
           )
         return await observePrivateFile(
-          { buffer, ...metadata, knowledge: metadata, path: reference, source: 'knowledge' },
+          {
+            buffer,
+            ...metadata,
+            knowledge: metadata,
+            path: reference,
+            source: 'knowledge',
+            hasRecordedSecrets,
+          },
           flags,
           query.data,
           runtime.signal
diff --git a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
index f6ccc0bb5e6..f2122de4cd2 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
@@ -1,3 +1,4 @@
+import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { AgentCliFlags } from '@/lib/mothership/agent-cli/types'
 import { agentCliOk } from '@/lib/mothership/agent-cli/types'
@@ -15,6 +16,8 @@ export async function observePrivateFile(
     path: string
     source: 'sandbox' | 'upload' | 'knowledge'
     contentType?: string
+    /** The bytes hold secrets whose text redaction a rendered image would bypass. */
+    hasRecordedSecrets?: boolean
     knowledge?: {
       documentId: string
       knowledgeBaseId: string
@@ -38,6 +41,9 @@ export async function observePrivateFile(
   const textRange = options.offset !== undefined || options.limit !== undefined
   const visual = flags.render !== undefined || flags.pages !== undefined
   if (visual || (!textRange && (type.startsWith('image/') || type === 'application/pdf'))) {
+    if (file.hasRecordedSecrets) {
+      throw new ContentRefusedError('workspace-file')
+    }
     const decoded = await decodeFileVisual({
       buffer: file.buffer,
       name: file.name,
diff --git a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
index d4496a4f677..b4df8bd8642 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
@@ -1,6 +1,6 @@
 import { sleep } from '@sim/utils/helpers'
 import { isRecordLike } from '@sim/utils/object'
-import { truncate } from '@sim/utils/string'
+import { escapeRegExp } from '@sim/utils/string'
 import type { ReadFileTextResponse } from 'sim/embed'
 import { listCatalogTools } from '@/lib/catalog/application/list-tools'
 import { readBlockCatalog } from '@/lib/catalog/application/read-block-catalog'
@@ -14,6 +14,9 @@ import {
   agentCliOk,
 } from '@/lib/mothership/agent-cli/types'
 import { buildIntegrationToolSchemas } from '@/lib/mothership/chat/payload'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { OPAQUE_RESOLVED_SECRET_REPLACEMENT } from '@/executor/utils/resolved-secret-matcher'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * `grep <pattern> [--scope a,b] [--in <world|id|name|world/id>] [-i] [-C n] [-A n] [-B n] [--count] [--limit n]` —
@@ -430,8 +433,36 @@ function compilePattern(raw: string, ignoreCase: boolean): (line: string) => boo
   return (line) => (ignoreCase ? line.toLowerCase() : line).includes(needle)
 }
 
+/** What redaction leaves in place of a secret: a `{{NAME}}` label or the opaque marker. */
+const REDACTION_MARKER = new RegExp(
+  `\\{\\{[^{}]+\\}\\}|${escapeRegExp(OPAQUE_RESOLVED_SECRET_REPLACEMENT)}`,
+  'g'
+)
+
+/** Clips redacted text, cutting before a redaction marker rather than through it. */
 function clip(line: string): string {
-  return truncate(line, MAX_LINE_CHARS, '… [line truncated]')
+  if (line.length <= MAX_LINE_CHARS) return line
+  let cut = MAX_LINE_CHARS
+  for (const marker of line.matchAll(REDACTION_MARKER)) {
+    if (marker.index >= cut) break
+    if (marker.index + marker[0].length > cut) {
+      cut = marker.index
+      break
+    }
+  }
+  return `${line.slice(0, cut)}… [line truncated]`
+}
+
+/**
+ * Model egress redacts whole secrets only, so a line clipped, or a multi-line secret split into
+ * lines, would carry a fragment it cannot recognize. The text is redacted whole first, through the
+ * same provenance egress uses; null means it could not be, and the resource is not searched.
+ * Without a registry egress withholds the whole result, so there is nothing to redact against.
+ */
+function redactForModel(text: string, egress: ResolvedSecretTraceRegistry | undefined) {
+  if (!egress) return text
+  const projection = projectResolvedSecretModelContent(text, egress)
+  return projection.safe && typeof projection.value === 'string' ? projection.value : null
 }
 
 function didYouMean(scope: string): string {
@@ -587,9 +618,17 @@ export const universalGrepCommand: AgentCliEngine = {
       }
       return now
     }
+    const egress = runtime.resolvedSecretTraceRegistry?.forkForPropagatedEntries()
     for (const resource of candidates) {
       if (resource.text === null) continue
-      const lines = resource.text.split('\n')
+      const text = redactForModel(resource.text, egress)
+      if (text === null) {
+        bounded.reportIncomplete(
+          `${resource.scope}/${resource.label} (${resource.id}): could not be checked for secret values, so it was not searched.`
+        )
+        continue
+      }
+      const lines = text.split('\n')
       const selected = new Map<number, boolean>()
       const remainingLines = limit - out.length
       let nextContextLine = 0
diff --git a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
index 893d05af5e5..83fc2c5d55f 100644
--- a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
@@ -43,6 +43,12 @@ vi.mock('@/lib/execution/remote-sandbox/session-file-snapshot', () => ({
 }))
 vi.mock('@/lib/mothership/chat/delegation', () => ({ mintDelegationToken: async () => 'fixture' }))
 
+import {
+  admitContent,
+  type ContentSource,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
@@ -52,9 +58,13 @@ vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
 }))
 
 import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
-import { reportWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { readWorkspaceFileArtifact } from '@/lib/workspace-files/application/read-workspace-file-artifact'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -83,6 +93,14 @@ mothershipWorkspaceTargetMockFns.mockResolveInvocationWorkspace.mockImplementati
 )
 
 const principal = createPersonalApiKeyPrincipal({ userId: 'reader', keyId: 'fixture-key' })
+const CHAT = createCopilotChatPrincipal(
+  { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
+  WORKSPACE_FILES_DELEGATION_AUDIENCE
+)
+
+function fileSource(id: string, provenance: ContentSource['provenance']): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view: 'opaque' }
+}
 const content = 'PRIVATE_FILE_CANARY_FOR_LOCAL_TEST'
 const revision = new Date('2026-09-06T00:00:00Z')
 const file = {
@@ -131,8 +149,21 @@ function grepFiles(pattern: string): CliInvocation {
   return { kind: 'augmentation', name: 'grep', positionals: [pattern], flags: { scope: 'files' } }
 }
 
+/**
+ * The CLI handler as the tool executor runs it: under the gate bound to the call's registry, which
+ * augmentation engines that call use cases in-process rely on.
+ */
+function simCli(...[params, context]: Parameters<typeof executeSimCli>) {
+  const gate = createRegistryContentGate({
+    registry: context.resolvedSecretTraceRegistry,
+    workspaceId: context.workspaceId,
+    actorUserId: context.userId,
+  })
+  return observeContentDelivery(gate, () => executeSimCli(params, context))
+}
+
 function runCli(invocation: CliInvocation, trace = registry()) {
-  return executeSimCli(
+  return simCli(
     { request: { invocation } },
     {
       userId: 'reader',
@@ -144,12 +175,19 @@ function runCli(invocation: CliInvocation, trace = registry()) {
   )
 }
 
-function readTransport(trace = registry()) {
-  return createFileReadTransport({
+const invocation = { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' }
+
+/** Chat's CLI transport as every invocation composes it: the registry gate around the routes. */
+function readTransport(trace = registry()): typeof fetch {
+  const transport = createAgentCliTransport({
     endpoint: 'https://sim.test',
-    userId: 'reader',
+    invocation,
     registry: trace,
+    resources: [],
+    observeReads: true,
   })
+  return (input, init) =>
+    withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () => transport(input, init))
 }
 
 function fileRequest(suffix = '', signal?: AbortSignal) {
@@ -202,15 +240,8 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       billedAccountUserId: 'owner',
     })
     classify('exact')
-    const transport = createFileReadTransport({
-      endpoint: 'https://sim.test',
-      userId: 'reader',
-      registry: registry(),
-      invocation: { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
-    })
-    const response = await withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
-      transport(fileRequest())
-    )
+    const transport = readTransport()
+    const response = await transport(fileRequest())
     expect(response.status).toBe(200)
     expect(await response.text()).toBe(content)
     expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
@@ -221,19 +252,26 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       allowPersonalApiKeys: false,
       billedAccountUserId: 'other',
     })
-    const denied = await withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
-      transport(fileRequest())
-    )
+    const denied = await transport(fileRequest())
     expect(denied.status).toBe(404)
     expect(mocks.stream).toHaveBeenCalledTimes(1)
   })
 
   it('refuses an otherwise authorized visual observation using the stored classification', async () => {
+    const gate = createRegistryContentGate({
+      registry: registry(),
+      workspaceId: 'workspace',
+      actorUserId: 'reader',
+    })
     await expect(
-      readWorkspaceFileArtifact.execute({
-        principal,
-        input: { workspaceId: 'workspace', reference: 'file', maxBytes: 1024 },
-      })
+      withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
+        observeContentDelivery(gate, () =>
+          readWorkspaceFileArtifact.execute({
+            principal: CHAT,
+            input: { workspaceId: 'workspace', reference: 'file', maxBytes: 1024 },
+          })
+        )
+      )
     ).rejects.toThrow('File cannot be sent to a model')
     expect(mocks.render).not.toHaveBeenCalled()
     expect(mocks.stream).not.toHaveBeenCalled()
@@ -247,7 +285,7 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
         { userId: 'reader', workspaceId: 'workspace' }
       )
       if (active) registry.recordResolved('FILE_SECRET', content, { propagated: true })
-      const result = await executeSimCli(
+      const result = await simCli(
         {
           request: {
             invocation: { kind: 'cli', argv: ['files', 'get', 'file'] },
@@ -280,17 +318,14 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     const projection = inspectToolResultForCopilot({ success: true, output }, trace, 'sim_cli')
     expect(JSON.stringify(projection.result)).toContain(content)
     expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(v2RouteMocks.authenticate).toHaveBeenCalledWith({
-      apiKey: 'fixture',
-      bearer: null,
-      malformedOAuthBearer: false,
-    })
+    /** Chat reads as its invocation's delegation, never as the credential a request carries. */
+    expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
   })
 
   it('keeps exact-empty file contents readable through the actual CLI handler', async () => {
     classify('exact')
     const trace = registry()
-    const result = await executeSimCli(
+    const result = await simCli(
       {
         request: {
           invocation: { kind: 'cli', argv: ['files', 'get', 'file'] },
@@ -311,26 +346,23 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.stream).toHaveBeenCalledTimes(1)
   })
 
-  it('refuses a forwarded response naming its unknown file, without blanking the invocation', async () => {
+  it('refuses only the unknown item of a forwarded response, naming it, without blanking the invocation', async () => {
     const refusals = getMockLogger('DurableSecretProvenancePersistence').error
     refusals.mockClear()
-    const trace = registry()
-    const transport = createFileReadTransport({
-      endpoint: 'https://sim.test',
-      userId: 'reader',
-      registry: trace,
-      invocation: { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
-      transport: async () => {
-        await reportWorkspaceFileDelivery({ status: 'exact', entries: [] }, 'clean')
-        await reportWorkspaceFileDelivery({ status: 'unknown' }, 'tainted')
-        return new Response(content)
-      },
+    const clean = fileSource('clean', { status: 'exact', entries: [] })
+    const tainted = fileSource('tainted', { status: 'unknown' })
+    let verdicts: boolean[] = []
+    vi.stubGlobal('fetch', async () => {
+      const admission = await admitContent(CHAT, [clean, tainted])
+      verdicts = [admission.admits(clean), admission.admits(tainted)]
+      return new Response('clean item')
     })
-    const response = await transport(
-      new Request('https://sim.test/api/v2/files/bulk-download?workspaceId=workspace')
+    const trace = registry()
+    const response = await readTransport(trace)(
+      'https://sim.test/api/v2/files/bulk-download?workspaceId=workspace'
     )
-    expect(response.status).toBe(403)
-    expect(await response.text()).not.toContain(content)
+    expect(response.status).toBe(200)
+    expect(verdicts).toEqual([true, false])
     expect(trace.isPermanentlyIncomplete()).toBe(false)
     expect(refusals).toHaveBeenCalledTimes(1)
     expect(refusals).toHaveBeenCalledWith(
@@ -339,6 +371,20 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     )
   })
 
+  it('refuses a successful forwarded response its sourced operation never classified', async () => {
+    vi.stubGlobal('fetch', async () => {
+      noteContentDeliveryOperation(fileOperations.download, CHAT)
+      return new Response(content)
+    })
+    const trace = registry()
+    const response = await readTransport(trace)(
+      'https://sim.test/api/v2/files/bulk-download?workspaceId=workspace'
+    )
+    expect(response.status).toBe(403)
+    expect(await response.text()).not.toContain(content)
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+  })
+
   it('refuses extracted text whose canonical revision changed before loading its bytes', async () => {
     resetDbChainMock()
     queueTableRows(workspaceFiles, [sidecarRow('exact', new Date(revision.getTime() + 1))])
@@ -497,6 +543,89 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     )
   })
 
+  describe('grep reshapes a file line only after redacting it', () => {
+    const secret = 'sk_live_P3_FIXTURE_0123456789abcdefghij'
+    const otherSecret = 'pk_test_P3_FIXTURE_ZYXWVUTSRQPONMLKJIH'
+    const keyBlock = [
+      '-----BEGIN FIXTURE KEY-----',
+      'MIIBFIXTUREKEYLINEONE0123456789',
+      'MIIBFIXTUREKEYLINETWO0123456789',
+      '-----END FIXTURE KEY-----',
+    ].join('\n')
+    const LINE_CHARS = 2_000
+    const pad = (from: number, to: number) => 'x'.repeat(to - from)
+
+    /** A secret leaks as soon as its first or last four characters, or one of its lines, cross. */
+    function fragments(value: string): string[] {
+      return [value.slice(0, 4), value.slice(-4), ...value.split('\n')]
+    }
+
+    async function grepSecretFile(text: string, pattern: string) {
+      const plaintexts: Record<string, string> = {
+        'cipher-file': secret,
+        'cipher-other': otherSecret,
+        'cipher-key': keyBlock,
+      }
+      mocks.decrypt.mockImplementation(async (cipher: string) => ({
+        decrypted: plaintexts[cipher],
+      }))
+      mocks.buffer.mockResolvedValue(Buffer.from(text))
+      vi.stubGlobal('fetch', async () =>
+        Response.json({
+          data: [{ ...file, size: Buffer.byteLength(text), updatedAt: revision.toISOString() }],
+          nextCursor: null,
+        })
+      )
+      resetDbChainMock()
+      queueTableRows(workspaceFiles, [
+        sidecarRow('exact', revision, [
+          { name: 'FILE_SECRET', encryptedValue: 'cipher-file', sourceUserId: 'reader' },
+          { name: 'OTHER_SECRET', encryptedValue: 'cipher-other', sourceUserId: 'reader' },
+          { name: 'KEY_BLOCK', encryptedValue: 'cipher-key', sourceUserId: 'reader' },
+        ]),
+      ])
+      const trace = registry()
+      const result = await runCli(grepFiles(pattern), trace)
+      const projection = inspectToolResultForCopilot(result, trace, 'sim_cli')
+      expect(projection.safe).toBe(true)
+      return JSON.stringify(projection.result)
+    }
+
+    it.each([
+      ['straddling the clip', `NEEDLE ${pad(7, LINE_CHARS - 10)}${secret} tail`],
+      [
+        'whose redaction marker would straddle the clip',
+        `NEEDLE ${pad(7, LINE_CHARS - 5)}${secret}`,
+      ],
+      ['wholly past the clip', `NEEDLE ${pad(7, LINE_CHARS + 50)}${secret} tail`],
+      [
+        'repeated around the clip with another secret',
+        `NEEDLE ${otherSecret} ${pad(48, LINE_CHARS - 12)}${secret}${otherSecret}${secret}`,
+      ],
+    ])('never returns a fragment of a secret %s', async (_case, line) => {
+      const projected = await grepSecretFile(`${line}\nsecond line`, 'NEEDLE')
+      expect(projected).toContain('NEEDLE')
+      expect(projected).toContain('[line truncated]')
+      for (const fragment of [...fragments(secret), ...fragments(otherSecret)]) {
+        expect(projected).not.toContain(fragment)
+      }
+      const withoutMarkers = projected
+        .replaceAll('{{FILE_SECRET}}', '')
+        .replaceAll('{{OTHER_SECRET}}', '')
+        .replaceAll('[REDACTED_SECRET]', '')
+      expect(withoutMarkers).not.toContain('{{')
+      expect(withoutMarkers).not.toContain('[RED')
+    })
+
+    it('never returns one line of a multi-line secret', async () => {
+      const projected = await grepSecretFile(
+        `config start\n${keyBlock}\nconfig end`,
+        'FIXTURE KEY|KEYLINE'
+      )
+      for (const fragment of fragments(keyBlock)) expect(projected).not.toContain(fragment)
+    })
+  })
+
   it('refuses an unknown file through the actual CLI text read without loading its bytes', async () => {
     classify('unknown')
     const result = await runCli(readFile)
@@ -532,7 +661,7 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       .png()
       .toBuffer()
     mocks.render.mockResolvedValue({ buffer: png, contentType: 'image/png' })
-    const result = await executeSimCli(
+    const result = await simCli(
       {
         request: {
           invocation: {
@@ -565,16 +694,6 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.buffer).not.toHaveBeenCalled()
   })
 
-  it('rejects a credential for a different actor before looking up the file', async () => {
-    v2RouteMocks.authenticate.mockResolvedValue({
-      principal: { ...principal, userId: 'someone-else' },
-    })
-    const response = await readTransport()(fileRequest())
-    expect(response.status).toBe(401)
-    expect(mocks.context).not.toHaveBeenCalled()
-    expect(mocks.stream).not.toHaveBeenCalled()
-  })
-
   it.each([
     'https://sim.test/api/v2/files/folders',
     'https://sim.test/api/v2/files/bulk-download',
@@ -582,8 +701,12 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     'https://other.test/api/v2/files/file',
   ])('leaves unrelated requests to the existing transport: %s', async (url) => {
     const fallback = vi.fn(async () => new Response('fallback'))
-    vi.stubGlobal('fetch', fallback)
-    expect(await (await readTransport()(url)).text()).toBe('fallback')
+    const transport = createFileReadTransport({
+      endpoint: 'https://sim.test',
+      transport: fallback,
+      invocation,
+    })
+    expect(await (await transport(url)).text()).toBe('fallback')
     expect(fallback).toHaveBeenCalledWith(url, undefined)
     expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
   })
@@ -596,13 +719,10 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.context).not.toHaveBeenCalled()
   })
 
-  it('does not begin a file lookup after Stop during authentication', async () => {
+  it('does not begin a file lookup after Stop before dispatch', async () => {
     const controller = new AbortController()
     const stopped = new Error('Stopped')
-    v2RouteMocks.authenticate.mockImplementation(async () => {
-      controller.abort(stopped)
-      return { principal }
-    })
+    controller.abort(stopped)
     await expect(readTransport()(fileRequest('', controller.signal))).rejects.toBe(stopped)
     expect(mocks.context).not.toHaveBeenCalled()
   })
diff --git a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
index 436ec74380d..c87c3725e26 100644
--- a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
@@ -1,165 +1,71 @@
 import { createLogger } from '@sim/logger'
 import { NextRequest } from 'next/server'
-import {
-  v2BulkDownloadFilesContract,
-  v2DownloadFileContract,
-  v2ListFileFoldersContract,
-  v2ReadFileTextContract,
-} from '@/lib/api/contracts/v2/files'
-import {
-  authenticateV2ApiKey,
-  V2ApiKeyUnauthenticatedError,
-} from '@/lib/api/server/routes/v2-api-key-auth'
-import { readV2CredentialHeaders } from '@/lib/api/server/routes/v2-credential-headers'
+import { v2DownloadFileContract, v2ReadFileTextContract } from '@/lib/api/contracts/v2/files'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { V2_PARSE_DEFAULTS } from '@/lib/api/server/routes/v2-json-route'
 import { parseRequest } from '@/lib/api/server/validation'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import {
   type CopilotChatDelegationContext,
   createCopilotChatPrincipal,
 } from '@/lib/mothership/auth/application-delegation'
-import {
-  importWorkspaceFileSnapshotProvenance,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-  mergeWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { v2FileErrorPolicies } from '@/lib/workspace-files/api'
 import { presentWorkspaceFileText } from '@/lib/workspace-files/api/text-presenter'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/download-workspace-file'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 import { readWorkspaceFileText } from '@/lib/workspace-files/application/read-workspace-file-text'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('MothershipFileReads')
 
-/** Private file-read metadata stays in the authenticated host; the CLI consumes its usual wire shape. */
+/** Contract paths in the generated route table's `{param}` pattern syntax. */
+const routePattern = (path: string) => path.replace(/\[([^\]]+)\]/g, '{$1}')
+const DOWNLOAD_PATTERN = routePattern(v2DownloadFileContract.path)
+const TEXT_PATTERN = routePattern(v2ReadFileTextContract.path)
+
+/**
+ * Answers the two single-file reads Chat needs beyond their public routes — a chat upload by its
+ * `uploads/` reference and plain source decoded as text — by calling their use cases directly.
+ * Every other request, file collections included, goes to the route the generated table names.
+ *
+ * Classification is not decided here: the gate the caller installed decides each file. A direct
+ * download alone takes the single-file exception (D7): an unknown file is delivered with the whole
+ * invocation withheld, and the workbench copy keeps the unknown classification.
+ */
 export function createFileReadTransport(context: {
   endpoint: string
-  transport?: typeof fetch
-  userId: string
-  invocation?: CopilotChatDelegationContext
-  chatId?: string
+  transport: typeof fetch
+  invocation: CopilotChatDelegationContext & { workspaceId: string }
   registry?: ResolvedSecretTraceRegistry
-  trackDownload?: (
-    stream: ReadableStream<Uint8Array>,
-    provenance?: WorkspaceFileSecretProvenance
-  ) => void
 }): typeof fetch {
   const base = new URL(context.endpoint)
   const basePath = base.pathname.replace(/\/$/, '')
-  const prefix = `${basePath}${v2DownloadFileContract.path.split('[fileId]')[0]}`
-  const collectionPaths = new Set([
-    `${basePath}${v2ListFileFoldersContract.path}`,
-    `${basePath}${v2BulkDownloadFilesContract.path}`,
-  ])
-  /**
-   * Admits one delivery's classification into the invocation registry. A delivery it refuses is
-   * either withheld (text and forwarded responses reach only the model, so refusing them is enough)
-   * or, for a direct download whose bytes can be persisted, delivered with the whole invocation
-   * marked incomplete so anything derived from the copy keeps the unknown classification.
-   */
-  const admit = async (
-    workspaceId: string,
-    provenance: WorkspaceFileSecretProvenance | undefined,
-    resourceId?: string
-  ): Promise<boolean> =>
-    provenance !== undefined &&
-    (await importWorkspaceFileSnapshotProvenance({
-      workspaceId,
-      provenance,
-      registry: context.registry,
-      actorUserId: context.userId,
-      resourceId,
-    }))
-  const refused = () =>
-    v2FileErrorPolicies.concealResourceAuthorization.render(
-      new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-    ) ??
-    Response.json(
-      { error: { message: MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE } },
-      { status: 403 }
-    )
 
-  const forward: typeof fetch = async (input, init) => {
+  return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input)
     const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    if (!context.invocation || method !== 'GET' || url.origin !== base.origin) {
-      return (context.transport ?? fetch)(input, init)
-    }
-    let provenance: WorkspaceFileSecretProvenance | undefined
-    const deliveries: { source: WorkspaceFileSecretProvenance | undefined; fileId: string }[] = []
-    const response = await observeWorkspaceFileDelivery(
-      async (source, fileId) => {
-        deliveries.push({ source, fileId })
-        provenance = mergeWorkspaceFileSecretProvenance(
-          provenance ?? { status: 'exact', entries: [] },
-          source ?? { status: 'unknown' }
-        )
-      },
-      () => (context.transport ?? fetch)(input, init)
-    )
-    if (!provenance) return response
-    try {
-      if (!context.registry) {
-        await response.body?.cancel().catch(() => {})
-        return Response.json(
-          { error: { message: 'File read provenance is unavailable. Retry the read.' } },
-          { status: 503 }
-        )
+    let route: ReturnType<typeof matchV2Route> = null
+    if (method === 'GET' && url.origin === base.origin && url.pathname.startsWith(`${basePath}/`)) {
+      try {
+        route = matchV2Route(url.pathname.slice(basePath.length))
+      } catch {
+        /** A malformed percent encoding names no file; the route answers it. */
       }
-      /** Each delivery is admitted under its own file id, so a refusal names the file it refused. */
-      for (const { source, fileId } of deliveries) {
-        if (!(await admit(context.invocation.workspaceId, source, fileId))) {
-          await response.body?.cancel().catch(() => {})
-          return refused()
-        }
-      }
-      if (response.body) context.trackDownload?.(response.body, provenance)
-      return response
-    } catch (error) {
-      await response.body?.cancel().catch(() => {})
-      throw error
     }
-  }
-
-  return async (input, init) => {
-    const url = new URL(input instanceof Request ? input.url : input)
-    const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    if (
-      method !== 'GET' ||
-      url.origin !== base.origin ||
-      !url.pathname.startsWith(prefix) ||
-      collectionPaths.has(url.pathname)
-    ) {
-      return forward(input, init)
+    if (!route || (route.pattern !== DOWNLOAD_PATTERN && route.pattern !== TEXT_PATTERN)) {
+      return context.transport(input, init)
     }
-    const match = /^([^/]+)(\/text)?$/.exec(url.pathname.slice(prefix.length))
-    if (!match) return forward(input, init)
     const request = new NextRequest(new Request(input, init))
     let stream: ReadableStream<Uint8Array> | undefined
     try {
       request.signal.throwIfAborted()
-      const principal = context.invocation
-        ? createCopilotChatPrincipal(context.invocation, WORKSPACE_FILES_DELEGATION_AUDIENCE)
-        : (await authenticateV2ApiKey(readV2CredentialHeaders(request.headers))).principal
-      request.signal.throwIfAborted()
-      if (
-        principal.kind === 'delegated'
-          ? principal.subjectUserId !== context.userId
-          : principal.kind !== 'personal_api_key' || principal.userId !== context.userId
-      ) {
-        throw new V2ApiKeyUnauthenticatedError()
-      }
-      if (!context.registry) {
-        return Response.json(
-          { error: { message: 'File read provenance is unavailable. Retry the read.' } },
-          { status: 503 }
-        )
-      }
-      const params = { fileId: decodeURIComponent(match[1] ?? '') }
-      if (match[2]) {
+      const principal = createCopilotChatPrincipal(
+        context.invocation,
+        WORKSPACE_FILES_DELEGATION_AUDIENCE
+      )
+      const params = { fileId: route.params.fileId ?? '' }
+      if (route.pattern === TEXT_PATTERN) {
         const parsed = await parseRequest(
           v2ReadFileTextContract,
           request,
@@ -168,27 +74,20 @@ export function createFileReadTransport(context: {
         )
         if (!parsed.success) return parsed.response
         request.signal.throwIfAborted()
-        const result = await observeWorkspaceFileDelivery(
-          async (source, fileId) => {
-            if (!(await admit(parsed.data.query.workspaceId, source, fileId))) {
-              throw new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-            }
+        const result = await readWorkspaceFileText.execute({
+          principal,
+          input: {
+            workspaceId: parsed.data.query.workspaceId,
+            reference: parsed.data.params.fileId,
+            ...(context.invocation.chatId !== undefined
+              ? { chatId: context.invocation.chatId }
+              : {}),
+            maxBytes: parsed.data.query.maxBytes,
+            offset: parsed.data.query.offset,
+            limit: parsed.data.query.limit,
+            allowPlainText: true,
           },
-          () =>
-            readWorkspaceFileText.execute({
-              principal,
-              input: {
-                workspaceId: parsed.data.query.workspaceId,
-                reference: parsed.data.params.fileId,
-                ...(context.chatId !== undefined ? { chatId: context.chatId } : {}),
-                maxBytes: parsed.data.query.maxBytes,
-                offset: parsed.data.query.offset,
-                limit: parsed.data.query.limit,
-                includeSecretProvenance: true,
-                allowPlainText: true,
-              },
-            })
-        )
+        })
         request.signal.throwIfAborted()
         return Response.json(presentWorkspaceFileText(result))
       }
@@ -200,44 +99,33 @@ export function createFileReadTransport(context: {
       )
       if (!parsed.success) return parsed.response
       request.signal.throwIfAborted()
-      const result = await observeWorkspaceFileDelivery(
-        async (source, fileId) => {
-          if (!(await admit(parsed.data.query.workspaceId, source, fileId))) {
-            context.registry?.markIncomplete('workspace-file-provenance-unknown')
-          }
-        },
+      const result = await observeContentDelivery(
+        createRegistryContentGate({
+          registry: context.registry,
+          workspaceId: parsed.data.query.workspaceId,
+          actorUserId: context.invocation.userId,
+          unknown: 'taint',
+        }),
         () =>
           downloadWorkspaceFileStream.execute({
             principal,
             input: {
               fileId: parsed.data.params.fileId,
               assertedWorkspaceId: parsed.data.query.workspaceId,
-              includeSecretProvenance: true,
             },
           })
       )
       stream = result.stream
       request.signal.throwIfAborted()
-      const response = new Response(
-        stream.pipeThrough(new TransformStream(), { signal: request.signal }),
-        {
-          headers: {
-            'content-type': result.contentType,
-            'content-length': String(result.contentLength),
-          },
-        }
-      )
-      if (response.body) context.trackDownload?.(response.body, result.secretProvenance)
-      return response
+      return new Response(stream.pipeThrough(new TransformStream(), { signal: request.signal }), {
+        headers: {
+          'content-type': result.contentType,
+          'content-length': String(result.contentLength),
+        },
+      })
     } catch (error) {
       await stream?.cancel().catch(() => {})
       request.signal.throwIfAborted()
-      if (error instanceof V2ApiKeyUnauthenticatedError) {
-        return Response.json(
-          { error: { code: 'UNAUTHORIZED', message: error.message } },
-          { status: 401 }
-        )
-      }
       const response = v2FileErrorPolicies.concealResourceAuthorization.render(error)
       if (response) return response
       logger.error('File read failed', { error })
diff --git a/apps/sim/lib/mothership/agent-cli/index.ts b/apps/sim/lib/mothership/agent-cli/index.ts
index 21ac35f2926..4d7a7b525dd 100644
--- a/apps/sim/lib/mothership/agent-cli/index.ts
+++ b/apps/sim/lib/mothership/agent-cli/index.ts
@@ -141,6 +141,7 @@ async function executeBoundAgentCliRequest(
               }
             : {}),
           ...(context.chatId !== undefined ? { chatId: context.chatId } : {}),
+          resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry,
           signal: context.signal,
         },
         invocation.flags
diff --git a/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts b/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts
deleted file mode 100644
index 944faec6b47..00000000000
--- a/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts
+++ /dev/null
@@ -1,287 +0,0 @@
-import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
-import {
-  mothershipWorkspaceTargetMock,
-  mothershipWorkspaceTargetMockFns,
-} from '@sim/testing/mocks/mothership-workspace-target.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const hoisted = vi.hoisted(() => ({ scoped: vi.fn() }))
-vi.mock('@/lib/core/security/encryption', () => encryptionMock)
-vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
-  createScopedCliTransport: () => hoisted.scoped,
-}))
-vi.mock('@/lib/mothership/application/workspace-target', () => mothershipWorkspaceTargetMock)
-vi.mock('@/lib/execution/remote-sandbox/session-files', () => ({
-  SESSION_SANDBOX_HOME: '/home/user',
-  readSessionSandboxFile: vi.fn(),
-  writeSessionSandboxFile: vi.fn(),
-}))
-vi.mock('@/lib/execution/remote-sandbox/session-file-snapshot', () => ({
-  openSessionFileSnapshot: vi.fn(),
-}))
-
-import { V2_ROUTES } from '@/lib/api/server/routes/v2-route-table.generated'
-import {
-  createTableReadTransport,
-  TABLE_ROUTES_WITHOUT_ROW_DATA,
-} from '@/lib/mothership/agent-cli/table-read-transport'
-import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
-import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
-import { reportTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
-
-const mocks = { ...hoisted, decrypt: encryptionMockFns.mockDecryptSecret }
-
-mothershipWorkspaceTargetMockFns.mockResolveInvocationWorkspace.mockImplementation(
-  async (owner: { userId: string }, workspaceId?: string) => ({
-    workspaceId: workspaceId ?? 'workspace',
-    userId: owner.userId,
-  })
-)
-
-const SECRET = 'PRIVATE_TABLE_CELL_CANARY_FOR_LOCAL_TEST'
-const scope = { userId: 'reader', workspaceId: 'workspace' }
-const endpoint = 'https://sim.test'
-const rowUrl = `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`
-const rowBody = { data: { id: 'row', data: { token: SECRET } } }
-
-function registry() {
-  return new ResolvedSecretTraceRegistry([], scope)
-}
-
-function secretProvenance() {
-  const source = new ResolvedSecretTraceRegistry(
-    [{ name: 'TABLE_SECRET', plaintext: SECRET, encryptedValue: 'fixture-ciphertext' }],
-    scope
-  )
-  source.recordResolved('TABLE_SECRET', SECRET, { propagated: true })
-  return source.exportProvenance()
-}
-
-/** Stands in for a v2 table route whose use case reports the rows it returns. */
-async function deliveringRoute() {
-  await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
-  return Response.json(rowBody)
-}
-
-function projected(output: string, trace: ResolvedSecretTraceRegistry) {
-  return JSON.stringify(inspectToolResultForCopilot({ success: true, output }, trace, 'sim_cli'))
-}
-
-describe('table provenance at the CLI and model-result boundary', () => {
-  beforeEach(() => {
-    mocks.decrypt.mockResolvedValue({ decrypted: SECRET })
-  })
-
-  it('activates reported row provenance so the model projection redacts the cell', async () => {
-    const trace = registry()
-    const inner = vi.fn(deliveringRoute)
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: inner,
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    const output = await response.text()
-    expect(output).toBe(JSON.stringify(rowBody))
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(projected(output, trace)).not.toContain(SECRET)
-  })
-
-  it('withholds a row-bearing result that reported no provenance', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () => Response.json(rowBody),
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
-    expect(projected(await response.text(), trace)).not.toContain(SECRET)
-  })
-
-  it('withholds a result whose run state carries error text without provenance', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
-          unprovenancedErrorText: true,
-        })
-        return Response.json(rowBody)
-      },
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
-    expect(trace.getIncompletenessDiagnostics()?.reasons).toEqual([
-      'table-run-state-provenance-unavailable',
-    ])
-  })
-
-  it('keeps a delivered result without run-state error text complete', async () => {
-    const trace = registry()
-    await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
-          unprovenancedErrorText: false,
-        })
-        return Response.json(rowBody)
-      },
-      registry: trace,
-    })(rowUrl)
-
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-  })
-
-  it.each(['GET', 'HEAD'])(
-    'refuses to return a table export download link (%s)',
-    async (method) => {
-      const trace = registry()
-      const inner = vi.fn(async () =>
-        Response.json({ data: { url: 'https://signed.test/export.csv' } })
-      )
-      const response = await createTableReadTransport({
-        endpoint,
-        transport: inner,
-        registry: trace,
-      })(`${endpoint}/api/v2/tables/table/exports/export/download?workspaceId=workspace`, {
-        method,
-      })
-
-      expect(response.status).toBe(403)
-      expect(await response.text()).not.toContain('signed.test')
-      expect(inner).not.toHaveBeenCalled()
-      expect(trace.isPermanentlyIncomplete()).toBe(false)
-    }
-  )
-
-  it('ignores provenance that detached work reports after the call settles', async () => {
-    const trace = registry()
-    let release!: () => void
-    const released = new Promise<void>((resolve) => {
-      release = resolve
-    })
-    let detached: Promise<void> | undefined
-    await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        detached = released.then(() =>
-          reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
-        )
-        return Response.json({ error: { message: 'Row not found' } }, { status: 404 })
-      },
-      registry: trace,
-    })(rowUrl)
-
-    release()
-    await detached
-    expect(projected(JSON.stringify(rowBody), trace)).toContain(SECRET)
-  })
-
-  it('refuses row reads without a registry instead of returning plaintext', async () => {
-    const inner = vi.fn(deliveringRoute)
-    const response = await createTableReadTransport({ endpoint, transport: inner })(rowUrl)
-
-    expect(response.status).toBe(503)
-    expect(await response.text()).not.toContain(SECRET)
-    expect(inner).not.toHaveBeenCalled()
-  })
-
-  it('keeps a failed row read from poisoning the turn', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () =>
-        Response.json({ error: { message: 'Row not found' } }, { status: 404 }),
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(404)
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-  })
-
-  it.each([
-    ['GET', `${endpoint}/api/v2/files/file?workspaceId=workspace`],
-    ['GET', `${endpoint}/api/v2/tables/table?workspaceId=workspace`],
-    ['POST', `${endpoint}/api/v2/tables/table/rows/search`],
-    ['DELETE', `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`],
-    ['GET', 'https://elsewhere.test/api/v2/tables/table/rows/row'],
-  ])('passes %s %s through untouched without a registry', async (method, url) => {
-    const upstream = Response.json({ data: { ok: true } })
-    const inner = vi.fn(async () => upstream)
-    const response = await createTableReadTransport({ endpoint, transport: inner })(url, {
-      method,
-    })
-
-    expect(response).toBe(upstream)
-    expect(inner).toHaveBeenCalledWith(url, { method })
-  })
-
-  it('composes into the sim_cli stack so a table read through the real CLI is redacted', async () => {
-    mocks.scoped.mockImplementation(deliveringRoute)
-    const trace = registry()
-    const result = await executeSimCli(
-      {
-        request: {
-          invocation: {
-            kind: 'cli',
-            argv: ['tables', 'rows', 'get', 'table', 'row'],
-          },
-        },
-      },
-      {
-        userId: 'reader',
-        workspaceId: 'workspace',
-        workflowId: '',
-        chatId: 'chat',
-        resolvedSecretTraceRegistry: trace,
-      }
-    )
-
-    expect(mocks.scoped).toHaveBeenCalled()
-    expect(new URL(String(mocks.scoped.mock.calls[0]?.[0])).pathname).toBe(
-      '/api/v2/tables/table/rows/row'
-    )
-    expect(JSON.stringify(result.output)).toContain(SECRET)
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(JSON.stringify(inspectToolResultForCopilot(result, trace, 'sim_cli'))).not.toContain(
-      SECRET
-    )
-  })
-
-  /**
-   * Every v2 table route is either declared row-free or must deliver provenance.
-   * A new route lands in the row-bearing set by default — its results are withheld
-   * until its use case reports delivery — and this list forces that to be a decision.
-   */
-  it('classifies every v2 table route', async () => {
-    const methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
-    const declared = new Set<string>()
-    for (const route of V2_ROUTES) {
-      if (route.pattern !== '/api/v2/tables' && !route.pattern.startsWith('/api/v2/tables/'))
-        continue
-      const module = await route.load()
-      for (const method of methods) {
-        if (typeof Reflect.get(module, method) === 'function')
-          declared.add(`${method} ${route.pattern}`)
-      }
-    }
-
-    expect([...TABLE_ROUTES_WITHOUT_ROW_DATA].filter((key) => !declared.has(key))).toEqual([])
-    expect([...declared].filter((key) => !TABLE_ROUTES_WITHOUT_ROW_DATA.has(key)).sort()).toEqual([
-      'GET /api/v2/tables/{tableId}/exports/{exportId}/download',
-      'GET /api/v2/tables/{tableId}/rows',
-      'GET /api/v2/tables/{tableId}/rows/{rowId}',
-      'GET /api/v2/tables/{tableId}/rows/{rowId}/enrichment/{groupId}',
-      'PATCH /api/v2/tables/{tableId}/rows/{rowId}',
-      'POST /api/v2/tables/{tableId}/query',
-      'POST /api/v2/tables/{tableId}/rows',
-      'POST /api/v2/tables/{tableId}/rows/upsert',
-    ])
-  }, 60_000)
-})
diff --git a/apps/sim/lib/mothership/agent-cli/table-read-transport.ts b/apps/sim/lib/mothership/agent-cli/table-read-transport.ts
deleted file mode 100644
index 2b4090f4fe7..00000000000
--- a/apps/sim/lib/mothership/agent-cli/table-read-transport.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
-
-/**
- * The v2 table routes whose responses carry no cell values, keyed `METHOD pattern`.
- * Every other table route — including one added later — must report the provenance
- * of the rows it returns, or its result is withheld from the model.
- */
-export const TABLE_ROUTES_WITHOUT_ROW_DATA: ReadonlySet<string> = new Set([
-  'GET /api/v2/tables',
-  'POST /api/v2/tables',
-  'POST /api/v2/tables/bulk-delete',
-  'GET /api/v2/tables/folders',
-  'POST /api/v2/tables/folders',
-  'PATCH /api/v2/tables/folders',
-  'DELETE /api/v2/tables/folders',
-  'POST /api/v2/tables/folders/restore',
-  'POST /api/v2/tables/imports',
-  'GET /api/v2/tables/imports/{importId}',
-  'DELETE /api/v2/tables/imports/{importId}',
-  'POST /api/v2/tables/imports/{importId}/complete',
-  'POST /api/v2/tables/imports/{importId}/parts',
-  'POST /api/v2/tables/move',
-  'GET /api/v2/tables/{tableId}',
-  'PATCH /api/v2/tables/{tableId}',
-  'DELETE /api/v2/tables/{tableId}',
-  'POST /api/v2/tables/{tableId}/cancel-runs',
-  'POST /api/v2/tables/{tableId}/columns',
-  'PATCH /api/v2/tables/{tableId}/columns',
-  'DELETE /api/v2/tables/{tableId}/columns',
-  'GET /api/v2/tables/{tableId}/dispatches',
-  'POST /api/v2/tables/{tableId}/dispatches',
-  'GET /api/v2/tables/{tableId}/dispatches/{dispatchId}',
-  'DELETE /api/v2/tables/{tableId}/dispatches/{dispatchId}',
-  'POST /api/v2/tables/{tableId}/exports',
-  'GET /api/v2/tables/{tableId}/exports/{exportId}',
-  'DELETE /api/v2/tables/{tableId}/exports/{exportId}',
-  'GET /api/v2/tables/{tableId}/groups',
-  'POST /api/v2/tables/{tableId}/groups',
-  'PATCH /api/v2/tables/{tableId}/groups',
-  'DELETE /api/v2/tables/{tableId}/groups',
-  'POST /api/v2/tables/{tableId}/query/count',
-  'POST /api/v2/tables/{tableId}/restore',
-  'PATCH /api/v2/tables/{tableId}/rows',
-  'DELETE /api/v2/tables/{tableId}/rows',
-  'DELETE /api/v2/tables/{tableId}/rows/{rowId}',
-  'POST /api/v2/tables/{tableId}/rows/{rowId}/enrichment/{groupId}',
-  'POST /api/v2/tables/{tableId}/rows/bulk-update',
-  'POST /api/v2/tables/{tableId}/rows/search',
-  'GET /api/v2/tables/{tableId}/views',
-  'POST /api/v2/tables/{tableId}/views',
-  'GET /api/v2/tables/{tableId}/views/{viewId}',
-  'PATCH /api/v2/tables/{tableId}/views/{viewId}',
-  'DELETE /api/v2/tables/{tableId}/views/{viewId}',
-])
-
-/**
- * An export download returns a signed link to the whole table as plaintext CSV, which no
- * provenance can follow once fetched, so the link is never returned to the model.
- */
-const TABLE_EXPORT_DOWNLOAD_PATTERN = '/api/v2/tables/{tableId}/exports/{exportId}/download'
-
-/**
- * Row data read through the CLI crosses into the model only with its persisted secret
- * provenance activated in the turn's registry; a row-bearing response that reported no
- * provenance marks the registry incomplete so the result is withheld. So does one whose
- * run state or enrichment detail carries error text: that text is captured from executor
- * output, which can hold resolved secret plaintext, and no provenance is persisted with it.
- */
-export function createTableReadTransport(context: {
-  endpoint: string
-  transport: typeof fetch
-  registry?: ResolvedSecretTraceRegistry
-}): typeof fetch {
-  const base = new URL(context.endpoint)
-  const basePath = base.pathname.replace(/\/$/, '')
-
-  return async (input, init) => {
-    const url = new URL(input instanceof Request ? input.url : input)
-    const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    const route =
-      url.origin === base.origin && url.pathname.startsWith(`${basePath}/api/v2/tables`)
-        ? matchV2Route(url.pathname.slice(basePath.length))
-        : null
-    if (!route || TABLE_ROUTES_WITHOUT_ROW_DATA.has(`${method} ${route.pattern}`)) {
-      return context.transport(input, init)
-    }
-    if (route.pattern === TABLE_EXPORT_DOWNLOAD_PATTERN) {
-      return Response.json(
-        {
-          error: {
-            message:
-              'Table export download links are not returned to Sim. Download the export from the Tables page.',
-          },
-        },
-        { status: 403 }
-      )
-    }
-    const registry = context.registry
-    if (!registry) {
-      return Response.json(
-        { error: { message: 'Table data cannot be returned to Sim in this context.' } },
-        { status: 503 }
-      )
-    }
-    let delivered = false
-    let unprovenancedErrorText = false
-    let settled = false
-    let response: Response
-    try {
-      response = await observeTableRowDelivery(
-        async (provenance, values, extras) => {
-          if (settled) return
-          delivered = true
-          if (extras.unprovenancedErrorText) unprovenancedErrorText = true
-          await registry.importCrossingProvenance(provenance, values, { trusted: true })
-        },
-        () => context.transport(input, init)
-      )
-    } finally {
-      settled = true
-    }
-    if (response.ok && !delivered) registry.markIncomplete('table-result-provenance-unavailable')
-    if (response.ok && unprovenancedErrorText) {
-      registry.markIncomplete('table-run-state-provenance-unavailable')
-    }
-    return response
-  }
-}
diff --git a/apps/sim/lib/mothership/agent-cli/transport.ts b/apps/sim/lib/mothership/agent-cli/transport.ts
index 06f6a0c88f8..b5b800d826e 100644
--- a/apps/sim/lib/mothership/agent-cli/transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/transport.ts
@@ -2,19 +2,24 @@ import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-tr
 import { createFileUploadTransport } from '@/lib/mothership/agent-cli/file-upload-transport'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
-import { createTableReadTransport } from '@/lib/mothership/agent-cli/table-read-transport'
 import { createTracedCliTransport } from '@/lib/mothership/agent-cli/traced-transport'
 import type { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import type { CopilotChatDelegationContext } from '@/lib/mothership/auth/application-delegation'
+import {
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+} from '@/lib/mothership/content-delivery/dispatch'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * The transport every Chat CLI invocation and augmentation engine reaches Sim through.
  *
- * Order is load-bearing: the file read layer sits outside in-process admission so every file
- * read and every other `GET` runs under a delivery observer that records the secret provenance
- * of the bytes, and resource effects observe what the composed stack returns.
+ * Every request, whatever its method, runs under a gate bound to the invocation's registry: each
+ * stored item a use case returns is admitted on its own, its secrets imported for redaction, and a
+ * `sourced` route that classified nothing is refused. Resource effects observe the gated result,
+ * and a workbench copy of delivered bytes keeps the classification of what was admitted.
  */
 export function createAgentCliTransport(context: {
   endpoint: string
@@ -25,19 +30,24 @@ export function createAgentCliTransport(context: {
   observeReads: boolean
 }): typeof fetch {
   const { endpoint, invocation, registry, files } = context
-  const reads = createFileReadTransport({
+  const gate = createRegistryContentGate({
+    registry,
+    workspaceId: invocation.workspaceId,
+    actorUserId: invocation.userId,
+  })
+  const routes = createFileReadTransport({
     endpoint,
-    transport: createTableReadTransport({
-      endpoint,
-      transport: createTracedCliTransport(endpoint, createScopedCliTransport(endpoint, invocation)),
-      registry,
-    }),
-    userId: invocation.userId,
+    transport: createTracedCliTransport(endpoint, createScopedCliTransport(endpoint, invocation)),
     invocation,
     registry,
-    ...(invocation.chatId !== undefined ? { chatId: invocation.chatId } : {}),
-    ...(files ? { trackDownload: files.trackDownload } : {}),
   })
+  const reads: typeof fetch = async (input, init) => {
+    const { response, admitted } = await dispatchUnderContentGate(gate, () => routes(input, init))
+    if (files && admitted.length > 0 && response.body) {
+      files.trackDownload(response.body, deliveredFileProvenance(admitted))
+    }
+    return response
+  }
   return createResourceEffectTransport(
     endpoint,
     files
diff --git a/apps/sim/lib/mothership/agent-cli/types.ts b/apps/sim/lib/mothership/agent-cli/types.ts
index f20c60d9f2e..a210e7042be 100644
--- a/apps/sim/lib/mothership/agent-cli/types.ts
+++ b/apps/sim/lib/mothership/agent-cli/types.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import type { CopilotChatDelegationContext } from '@/lib/mothership/auth/application-delegation'
 import type { AgentCliRawResult } from '@/lib/mothership/generated/agent-cli'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 /**
  * Sim's half of the mothership↔CLI translation layer: generic execution PRIMITIVES.
  * The worker owns the grammar (what commands exist, how argv parses, pipes, help, the
@@ -36,6 +37,11 @@ export interface AgentCliRuntime {
   /** The human the command acts as — reference resolution and grants scope to them. */
   userId: string
   chatId?: string
+  /**
+   * The invocation's secret provenance, which model egress redacts the result with. Egress
+   * matches whole secrets, so an engine that clips or splits text it read redacts it here first.
+   */
+  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
   signal?: AbortSignal
 }
 
diff --git a/apps/sim/lib/mothership/application/application-adapter.test.ts b/apps/sim/lib/mothership/application/application-adapter.test.ts
index 9e02fe214e0..e96924714a8 100644
--- a/apps/sim/lib/mothership/application/application-adapter.test.ts
+++ b/apps/sim/lib/mothership/application/application-adapter.test.ts
@@ -11,6 +11,7 @@ import {
 
 const operation = defineWorkspaceOperation({
   id: 'files.read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
@@ -81,6 +82,7 @@ describe('Copilot application adapter', () => {
     const executeCopilotUseCase = createAdapter()
     const unregistered = defineWorkspaceOperation({
       id: 'files.unregistered',
+      contentDelivery: 'none',
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
@@ -89,6 +91,7 @@ describe('Copilot application adapter', () => {
     })
     const sameIdDifferentPolicy = defineWorkspaceOperation({
       id: operation.id,
+      contentDelivery: 'none',
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
diff --git a/apps/sim/lib/mothership/application/operations.ts b/apps/sim/lib/mothership/application/operations.ts
index 7051af5b838..549f8e39ff7 100644
--- a/apps/sim/lib/mothership/application/operations.ts
+++ b/apps/sim/lib/mothership/application/operations.ts
@@ -12,6 +12,7 @@ export const chatOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -23,6 +24,7 @@ export const chatOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/mothership/application/workspace-target.ts b/apps/sim/lib/mothership/application/workspace-target.ts
index d5066882b6a..ae3f9fb5520 100644
--- a/apps/sim/lib/mothership/application/workspace-target.ts
+++ b/apps/sim/lib/mothership/application/workspace-target.ts
@@ -68,6 +68,7 @@ const headlessTargetOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
index c6f11fba754..76cd0bd01b2 100644
--- a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
+++ b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
@@ -8,6 +8,7 @@ import {
   type WorkspaceAuthorizationOptions,
   type WorkspaceOperation,
 } from '@/lib/core/application'
+import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
 import type { OrganizationOperation } from '@/lib/core/application/organization-operation'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
@@ -128,11 +129,16 @@ export function defineAuthorizedChatUseCase<
           request,
         })
       const execution = { principal: resolved.principal, input, context: resolved.context, request }
-      return runWithOutboundOrganization(resolved.organizationId, async () => {
-        const result = await definition.execute(execution)
-        await definition.afterSuccess?.({ ...execution, result })
-        return result
-      })
+      return runWithOutboundOrganization(resolved.organizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          resolved.principal,
+          () => definition.execute(execution),
+          async (result) => {
+            await definition.afterSuccess?.({ ...execution, result })
+          }
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.test.ts b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
index b004fee8a2d..8f8b7acb9c0 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.test.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
@@ -40,6 +40,11 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-artifact', () =>
 }))
 vi.mock('@/lib/execution/remote-sandbox', () => remoteSandboxMock)
 
+import {
+  admitContent,
+  ContentRefusedError,
+  requireAdmittedContent,
+} from '@/lib/core/application/content-delivery'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   materializeInlineChatImage,
@@ -71,6 +76,20 @@ function ownChat() {
   queueTableRows(copilotChats, [owner])
 }
 const missing = () => Object.assign(new Error('missing'), { code: 'ENOENT' })
+/** Stands in for a source read that classifies the clean image it returns, as the real reads do. */
+function admittedRead(buffer: Buffer) {
+  return async ({ principal }: { principal: Principal }) => {
+    await admitContent(principal, [
+      {
+        kind: 'workspace-file',
+        id: 'image',
+        provenance: { status: 'exact', entries: [] },
+        view: 'opaque',
+      },
+    ])
+    return { buffer }
+  }
+}
 async function raster() {
   return sharp({ create: { width: 4, height: 3, channels: 3, background: '#ee2244' } })
     .png()
@@ -183,7 +202,7 @@ describe('private chat image application boundary', () => {
   )
   it('accepts the existing chat-scoped Copilot file delegation', async () => {
     ownChat()
-    mocks.artifact.mockResolvedValue({ buffer: await raster() })
+    mocks.artifact.mockImplementation(admittedRead(await raster()))
     await materializeStreamImage(
       { userId: 'owner', workspaceId: 'workspace', chatId: 'chat' },
       input
@@ -195,6 +214,26 @@ describe('private chat image application boundary', () => {
       resourceScope: { chatId: 'chat' },
     })
   })
+  it('refuses to stream an image whose source holds a recorded secret', async () => {
+    ownChat()
+    const buffer = await raster()
+    mocks.artifact.mockImplementation(async ({ principal }: { principal: Principal }) => {
+      await requireAdmittedContent(principal, {
+        kind: 'workspace-file',
+        id: 'image',
+        provenance: {
+          status: 'exact',
+          entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'owner' }],
+        },
+        view: 'opaque',
+      })
+      return { buffer }
+    })
+    await expect(
+      materializeStreamImage({ userId: 'owner', workspaceId: 'workspace', chatId: 'chat' }, input)
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
   it('refuses decoder failure without upload', async () => {
     ownChat()
     mocks.artifact.mockResolvedValue({ buffer: Buffer.from('broken') })
@@ -274,7 +313,7 @@ describe('organization inline images', () => {
   }
   it('publishes scratch using the org chat delegation with no default workspace', async () => {
     ownOrgChat()
-    mocks.scratch.mockResolvedValue({ buffer: await raster() })
+    mocks.scratch.mockImplementation(admittedRead(await raster()))
     await materializeStreamImage(
       { userId: 'owner', organizationId: 'org', chatId: 'chat' },
       { ...input, reference: '/tmp/chart.png' }
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.ts b/apps/sim/lib/mothership/chat/application/inline-images.ts
index 13bae0da512..281b3edc0e5 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { defineWorkspaceOperation } from '@/lib/core/application'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
@@ -23,6 +24,7 @@ import {
   normalizeInlineChatImage,
   storeInlineChatImage,
 } from '@/lib/mothership/chat/inline-image-storage'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { loadActiveWorkspaceFileContext } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { MAX_TEXT_EXTRACTION_BYTES } from '@/lib/uploads/utils/file-utils'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
@@ -83,11 +85,13 @@ export const materializeInlineChatImage = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'personal_api_key', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.publish_image',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
@@ -190,24 +194,35 @@ export function materializeStreamImage(
   ),
   input: { requestId: string; reference: string; signal?: AbortSignal }
 ) {
-  return materializeInlineChatImage.execute({
-    principal: context.organizationId
-      ? createTrustedOrganizationCopilotPrincipal(
-          {
-            ...context,
-            organizationId: context.organizationId,
-            delegationId: `chat-image:${context.chatId}`,
-          },
-          {
-            audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
-            ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
-          }
-        )
-      : createCopilotChatFilePrincipal({
-          userId: context.userId,
-          chatId: context.chatId,
-          workspaceId: context.workspaceId!,
-        }),
-    input: { ...input, chatId: context.chatId },
+  /**
+   * A streamed image is opaque: no redaction reaches its pixels, so the gate admits only a clean
+   * or unrecorded source and refuses one holding a recorded secret, whatever registry exists.
+   */
+  const gate = createRegistryContentGate({
+    workspaceId: context.workspaceId,
+    organizationId: context.organizationId,
+    actorUserId: context.userId,
   })
+  return observeContentDelivery(gate, () =>
+    materializeInlineChatImage.execute({
+      principal: context.organizationId
+        ? createTrustedOrganizationCopilotPrincipal(
+            {
+              ...context,
+              organizationId: context.organizationId,
+              delegationId: `chat-image:${context.chatId}`,
+            },
+            {
+              audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
+              ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+            }
+          )
+        : createCopilotChatFilePrincipal({
+            userId: context.userId,
+            chatId: context.chatId,
+            workspaceId: context.workspaceId!,
+          }),
+      input: { ...input, chatId: context.chatId },
+    })
+  )
 }
diff --git a/apps/sim/lib/mothership/chat/application/operations.ts b/apps/sim/lib/mothership/chat/application/operations.ts
index 83a08459cee..09ee33d006c 100644
--- a/apps/sim/lib/mothership/chat/application/operations.ts
+++ b/apps/sim/lib/mothership/chat/application/operations.ts
@@ -16,6 +16,7 @@ export const mothershipChatOperations = {
     id: 'mothership.chats.list',
     ...workspacePolicy,
     capability: 'none',
+    contentDelivery: 'none',
   }),
   restore: Object.freeze({
     // permission-group-exempt: restoring and listing a user's own chats preserves workspace access policy.
@@ -23,10 +24,12 @@ export const mothershipChatOperations = {
       id: 'mothership.chats.restore',
       ...workspacePolicy,
       capability: 'none',
+      contentDelivery: 'none',
     }),
     // permission-group-exempt: restoring and listing a user's own chats preserves workspace access policy.
     organizationOperation: defineOrganizationOperation({
       id: 'mothership.chats.restore',
+      contentDelivery: 'none',
       minimumRole: 'member',
       principalKinds: ['session', 'organization_delegated'],
       delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/mothership/chat/application/read-attachment.ts b/apps/sim/lib/mothership/chat/application/read-attachment.ts
index 73b4d0e5580..08929ca0175 100644
--- a/apps/sim/lib/mothership/chat/application/read-attachment.ts
+++ b/apps/sim/lib/mothership/chat/application/read-attachment.ts
@@ -1,7 +1,9 @@
 import type { Principal } from '@sim/auth/principal'
 import { defineWorkspaceOperation } from '@/lib/core/application'
+import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
 import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
 import { loadChatFileAttachmentsNamed } from '@/lib/mothership/chat/lifecycle'
@@ -15,11 +17,13 @@ export const readChatAttachment = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.read_attachment',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'organization_delegated'],
@@ -64,6 +68,13 @@ export const readChatAttachment = defineAuthorizedChatUseCase({
       )
     const file = matches.values().next().value
     if (!file) throw new OrchestrationError('not_found', 'Chat attachment not found')
+    /** A member's own upload to this chat carries no secret Sim resolved into it. */
+    await requireAdmittedContent(principal, {
+      kind: 'workspace-file',
+      id: file.id,
+      provenance: EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
+      view: 'complete',
+    })
     return readOrganizationChatAttachment({
       principal,
       organizationId: context.organizationId,
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
index 98bd6590cee..a6df5035da0 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
@@ -6,7 +6,12 @@ import {
 } from '@sim/testing/factories/principal.factory'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 
 const hoisted = vi.hoisted(() => ({
   context: vi.fn(),
@@ -39,6 +44,19 @@ const mocks = {
 }
 
 const principal: Principal = createSessionPrincipal({ userId: 'u', sessionId: 's' })
+const chatPrincipal = createCopilotChatFilePrincipal({
+  userId: 'u',
+  workspaceId: 'ws',
+  chatId: 'chat',
+})
+
+/** Chat's reads run under the gate its transport installs; no registry, so secrets are refused. */
+function readAsChat(scope: { principal?: Principal } = {}) {
+  return observeContentDelivery(
+    createRegistryContentGate({ workspaceId: 'ws', actorUserId: 'u' }),
+    () => readChatSandboxFile.execute({ principal: scope.principal ?? chatPrincipal, input })
+  )
+}
 const input = { workspaceId: 'ws', chatId: 'chat', path: '/tmp/image.png' }
 const machine = { providerId: 'e2b', sandboxId: 'physical' }
 beforeEach(() => {
@@ -73,6 +91,7 @@ describe('owned scratch snapshot reads', () => {
       buffer: Buffer.from('png'),
       name: 'image.png',
       path: input.path,
+      hasRecordedSecrets: false,
     })
     expect(mocks.context).toHaveBeenCalledWith(principal, 'chat')
     expect(mocks.snapshot).toHaveBeenCalledWith(
@@ -97,12 +116,23 @@ describe('owned scratch snapshot reads', () => {
   it.each([
     { status: 'unknown' },
     { status: 'exact', entries: [{ encryptedValue: 'secret', sourceUserId: 'u' }] },
-  ])('refuses explicit unknown or secret-bearing opaque file provenance: %j', async (receipt) => {
-    mocks.receipt.mockReturnValue(receipt)
-    await expect(readChatSandboxFile.execute({ principal, input })).rejects.toThrow(
-      'no verified secret-free provenance'
-    )
-    expect(mocks.dispose).toHaveBeenCalledOnce()
+  ])(
+    'refuses Chat explicit unknown or unredactable secret-bearing provenance: %j',
+    async (receipt) => {
+      mocks.receipt.mockReturnValue(receipt)
+      await expect(readAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mocks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+  it('serves the user their own scratch file whatever its provenance, flagging recorded secrets', async () => {
+    mocks.receipt.mockReturnValue({
+      status: 'exact',
+      entries: [{ encryptedValue: 'secret', sourceUserId: 'u' }],
+    })
+    expect(await readChatSandboxFile.execute({ principal, input })).toMatchObject({
+      name: 'image.png',
+      hasRecordedSecrets: true,
+    })
   })
   it('enforces size before streaming and still disposes the snapshot', async () => {
     await expect(
@@ -128,14 +158,7 @@ describe('owned scratch snapshot reads', () => {
 
 describe('scoped chat file delegation', () => {
   it('accepts the canonical owned chat principal without minting an API key', async () => {
-    const delegated = createCopilotChatFilePrincipal({
-      userId: 'u',
-      workspaceId: 'ws',
-      chatId: 'chat',
-    })
-    expect((await readChatSandboxFile.execute({ principal: delegated, input })).name).toBe(
-      'image.png'
-    )
+    expect((await readAsChat()).name).toBe('image.png')
   })
   it.each(['chat', 'audience', 'expired', 'file'])(
     'denies wrong %s delegation before sandbox access',
@@ -173,9 +196,7 @@ it('rejects a workspace API key before canonical lookup or sandbox access', asyn
   expect(mocks.snapshot).not.toHaveBeenCalled()
 })
 
-it('permits a source explicitly classified as unrecorded', async () => {
+it('permits Chat a source explicitly classified as unrecorded', async () => {
   mocks.receipt.mockReturnValue({ status: 'unrecorded' })
-  expect((await readChatSandboxFile.execute({ principal, input })).buffer).toEqual(
-    Buffer.from('png')
-  )
+  expect((await readAsChat()).buffer).toEqual(Buffer.from('png'))
 })
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
index cd5b9fe8543..c1268a02875 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
@@ -1,10 +1,10 @@
 import { posix } from 'node:path'
 import type { Principal } from '@sim/auth/principal'
 import { defineWorkspaceOperation } from '@/lib/core/application'
+import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { readStreamToBufferWithLimit } from '@/lib/core/utils/stream-limits'
-import { reportDurableSecretProvenanceUnrecorded } from '@/lib/execution/durable-secret-provenance-telemetry'
 import { openSessionFileSnapshot } from '@/lib/execution/remote-sandbox/session-file-snapshot'
 import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
@@ -43,11 +43,13 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'personal_api_key', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.read_sandbox_file',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
@@ -77,7 +79,7 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
         principal.resourceScope?.fileId === undefined,
     },
   },
-  async execute({ context, input }) {
+  async execute({ context, input, principal }) {
     const path = normalizeScratchPath(input.path)
     const maxBytes = input.maxBytes ?? MAX_TEXT_EXTRACTION_BYTES
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_TEXT_EXTRACTION_BYTES) {
@@ -111,25 +113,20 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
       })
       input.signal?.throwIfAborted()
       const receipt = provenance.uploadProvenance()
-      if (
-        receipt.status === 'unknown' ||
-        (receipt.status === 'exact' && receipt.entries.length > 0)
-      ) {
-        throw new OrchestrationError(
-          'forbidden',
-          'This scratch file has no verified secret-free provenance. Read a verified source or regenerate it in a fresh workbench.'
-        )
-      }
+      await requireAdmittedContent(principal, {
+        kind: 'workspace-file',
+        id: path,
+        provenance: receipt,
+        view: 'complete',
+      })
       input.signal?.throwIfAborted()
-      if (receipt.status === 'unrecorded') {
-        reportDurableSecretProvenanceUnrecorded({
-          surface: 'workspace-file',
-          workspaceId: context.workspaceId,
-          organizationId: context.organizationId,
-          actorUserId: context.userId,
-        })
+      return {
+        buffer,
+        path,
+        name: posix.basename(path),
+        /** A visual of these bytes would show what text redaction hides. */
+        hasRecordedSecrets: receipt.status === 'exact' && receipt.entries.length > 0,
       }
-      return { buffer, path, name: posix.basename(path) }
     } finally {
       await snapshot.dispose()
     }
diff --git a/apps/sim/lib/mothership/chat/application/workspace-context.ts b/apps/sim/lib/mothership/chat/application/workspace-context.ts
index 9f8cb686405..035b27a48e6 100644
--- a/apps/sim/lib/mothership/chat/application/workspace-context.ts
+++ b/apps/sim/lib/mothership/chat/application/workspace-context.ts
@@ -12,6 +12,7 @@ export const readWorkspaceContextOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
@@ -20,6 +21,7 @@ export const readWorkspaceContext = defineAuthorizedChatUseCase({
   operation: readWorkspaceContextOperation,
   organizationOperation: defineOrganizationOperation({
     id: readWorkspaceContextOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/chat/application/workspace-target.ts b/apps/sim/lib/mothership/chat/application/workspace-target.ts
index 3f809156a22..4699f9eef99 100644
--- a/apps/sim/lib/mothership/chat/application/workspace-target.ts
+++ b/apps/sim/lib/mothership/chat/application/workspace-target.ts
@@ -14,6 +14,7 @@ const targetOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['session', 'personal_api_key', 'delegated'],
   delegatedServices: ['copilot'],
 })
@@ -23,6 +24,7 @@ export const authorizeChatWorkspaceTarget = defineAuthorizedChatUseCase({
   operation: targetOperation,
   organizationOperation: defineOrganizationOperation({
     id: targetOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
diff --git a/apps/sim/lib/mothership/chat/organization-chats.ts b/apps/sim/lib/mothership/chat/organization-chats.ts
index d0fc8d50251..33007ef3755 100644
--- a/apps/sim/lib/mothership/chat/organization-chats.ts
+++ b/apps/sim/lib/mothership/chat/organization-chats.ts
@@ -31,6 +31,7 @@ export const organizationChatOperations = {
   }),
   list: defineOrganizationOperation({
     id: 'organization.chats.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -160,6 +161,7 @@ export const organizationChatDelegationOperations = {
    */
   cancel: defineOrganizationOperation({
     id: 'organization.chats.cancel',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     capability: 'none',
@@ -168,6 +170,7 @@ export const organizationChatDelegationOperations = {
   }),
   settings: defineOrganizationOperation({
     id: 'organization.chats.settings',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -176,6 +179,7 @@ export const organizationChatDelegationOperations = {
   }),
   workspaces: defineOrganizationOperation({
     id: 'organization.chats.workspaces',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -184,6 +188,7 @@ export const organizationChatDelegationOperations = {
   }),
   knowledge: defineOrganizationOperation({
     id: 'organization.chats.knowledge',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -192,6 +197,7 @@ export const organizationChatDelegationOperations = {
   }),
   secrets: defineOrganizationOperation({
     id: 'organization.chats.secrets',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -200,6 +206,7 @@ export const organizationChatDelegationOperations = {
   }),
   billing: defineOrganizationOperation({
     id: 'organization.chats.admit',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 18d7a4fd78c..2a1dc81c6ef 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -8,6 +8,7 @@ import {
 import { escapeRegExp } from '@sim/utils/string'
 import { eq } from 'drizzle-orm'
 import type { MothershipTableViewContext } from '@/lib/api/contracts/mothership-resources'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
@@ -51,6 +52,7 @@ import {
   truncateSelectionText,
 } from '@/lib/mothership/chat/selection-context'
 import { quoteChatTranscript } from '@/lib/mothership/chat/text-transcript'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { QueryLogs } from '@/lib/mothership/generated/tool-catalog-v1'
 import { canonicalWorkspaceFilePath } from '@/lib/mothership/vfs/path-utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
@@ -71,7 +73,8 @@ import { readWorkflowMetadata } from '@/lib/workflows/application/read-workflow'
 import { getBuiltinSkillById } from '@/lib/workflows/skills/builtin-skills'
 import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import { getBlockRegistry } from '@/blocks/registry'
-import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import type { BrowserTextSelection, ChatContext, TerminalTextSelection } from '@/stores/panel'
 
 type AgentContextType =
@@ -346,7 +349,8 @@ export async function processContextsServer(
         ctx.columnIds,
         ctx.label,
         userId,
-        chatId
+        chatId,
+        resolvedSecretTraceRegistry
       )
     }
     if ((ctx.kind === 'folder' || ctx.kind === 'filefolder') && workspaceId) {
@@ -1126,7 +1130,8 @@ async function resolveTableSelectionResource(
   columnIds: string[] | undefined,
   label: string,
   userId: string,
-  chatId?: string
+  chatId?: string,
+  turnRegistry?: ResolvedSecretTraceRegistry
 ): Promise<AgentContext | null> {
   if (
     rowIds.length > MAX_TABLE_SELECTION_ROWS ||
@@ -1153,17 +1158,31 @@ async function resolveTableSelectionResource(
   if (columns.length === 0) return null
 
   const uniqueRowIds = [...new Set(rowIds)]
-  const result = await queryTableRows.execute({
-    principal,
-    input: {
-      tableId,
-      assertedWorkspaceId: workspaceId,
-      predicate: { all: [{ field: 'id', op: 'in', value: uniqueRowIds }] },
-      legacyKeying: 'ids',
-      columns: columns.map(getColumnId),
-      limit: uniqueRowIds.length,
-      includeTotal: true,
-    },
+  /**
+   * The preview is inlined into the turn as text no later projection reads, so it is redacted
+   * here: each row is admitted on its own against a selection-local registry, which then redacts
+   * the preview and hands its secrets to the turn's registry for everything after.
+   */
+  const selectionRegistry = new ResolvedSecretTraceRegistry([], { userId, workspaceId })
+  const result = await observeContentDelivery(
+    createRegistryContentGate({ registry: selectionRegistry, workspaceId, actorUserId: userId }),
+    () =>
+      queryTableRows.execute({
+        principal,
+        input: {
+          tableId,
+          assertedWorkspaceId: workspaceId,
+          predicate: { all: [{ field: 'id', op: 'in', value: uniqueRowIds }] },
+          legacyKeying: 'ids',
+          columns: columns.map(getColumnId),
+          limit: uniqueRowIds.length,
+          includeTotal: true,
+        },
+      })
+  )
+  await turnRegistry?.importProvenance(selectionRegistry.exportProvenance(), {
+    trusted: true,
+    origin: 'chatContext.tableSelection',
   })
   const rowsById = new Map(result.rows.map((row) => [row.id, row]))
   const rows = uniqueRowIds.flatMap((id) => {
@@ -1214,10 +1233,18 @@ async function resolveTableSelectionResource(
   }
 
   const rendered = `${describe(sizeClause(lines.length, selectedRowCount - lines.length))}${lines.join('\n')}`
+  const projected = projectResolvedSecretModelContent(rendered, selectionRegistry)
+  const withheldRows = uniqueRowIds.length - rows.length
+  const withheldNote =
+    withheldRows > 0
+      ? `\n\n${withheldRows} selected ${withheldRows === 1 ? 'row is' : 'rows are'} not shown: ${withheldRows === 1 ? 'its' : 'their'} secret provenance could not be verified.`
+      : ''
   const preview =
-    rendered.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
-      ? rendered
-      : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
+    !projected.safe || typeof projected.value !== 'string'
+      ? `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). Cell values could not be checked for secret values, so none were inlined.`
+      : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
+        ? `${projected.value}${withheldNote}`
+        : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
   const content = `${selection}\n\n${preview}`
   return {
     type: 'table_selection',
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
new file mode 100644
index 00000000000..9066d48e716
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
@@ -0,0 +1,136 @@
+/**
+ * @vitest-environment node
+ */
+import type { Principal } from '@sim/auth/principal'
+import { describe, expect, it } from 'vitest'
+import {
+  admitContent,
+  type ContentDeliveryGate,
+  type ContentSource,
+  noteContentDeliveryOperation,
+} from '@/lib/core/application/content-delivery'
+import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+import {
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+} from '@/lib/mothership/content-delivery/dispatch'
+
+const now = Date.now()
+const CHAT: Principal = {
+  kind: 'delegated',
+  serviceId: 'copilot',
+  subjectUserId: 'user-1',
+  workspaceId: 'workspace-1',
+  delegationId: 'delegation-1',
+  audience: 'sim:test',
+  issuedAt: new Date(now),
+  expiresAt: new Date(now + 60_000),
+}
+
+const SOURCED = defineWorkspaceOperation({
+  id: 'test.sourced',
+  contentDelivery: 'sourced',
+  minimumRole: 'read',
+  workspaceApiKey: 'deny',
+  principalKinds: ['delegated'],
+  delegatedServices: ['copilot'],
+  capability: 'none',
+})
+
+const ENTRY = { encryptedValue: 'ciphertext-1', sourceUserId: 'user-1', name: 'TOKEN' }
+
+const ADMIT_ALL: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(() => true)
+  },
+}
+
+const SOURCE: ContentSource = {
+  kind: 'workspace-file',
+  id: 'file-1',
+  provenance: { status: 'exact', entries: [ENTRY] },
+  view: 'complete',
+}
+
+describe('dispatchUnderContentGate', () => {
+  it('rethrows a gate failure the route had mapped to its own error response', async () => {
+    const failure = new Error('history unavailable')
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw failure
+      },
+    }
+    await expect(
+      dispatchUnderContentGate(failing, async () => {
+        try {
+          await admitContent(CHAT, [SOURCE])
+        } catch {
+          return Response.json({ error: 'internal' }, { status: 500 })
+        }
+        return Response.json({ data: 'unreachable' })
+      })
+    ).rejects.toBe(failure)
+  })
+
+  it('replaces any successful response that never classified its content with a 403', async () => {
+    for (const status of [200, 201]) {
+      const { response, admitted } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+        noteContentDeliveryOperation(SOURCED, CHAT)
+        return Response.json({ data: 'unclassified content' }, { status })
+      })
+      expect(response.status).toBe(403)
+      const body = await response.text()
+      expect(body).not.toContain('unclassified content')
+      expect(JSON.parse(body)).toMatchObject({ error: { code: 'FORBIDDEN' } })
+      expect(admitted).toEqual([])
+    }
+  })
+
+  it('passes an error response through, since it carries no content to classify', async () => {
+    const { response } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return Response.json({ error: { code: 'NOT_FOUND' } }, { status: 404 })
+    })
+    expect(response.status).toBe(404)
+  })
+
+  it('passes a classified response with the provenance of what it admitted', async () => {
+    const { response, admitted } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      await admitContent(CHAT, [SOURCE])
+      return Response.json({ data: 'classified' })
+    })
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ data: 'classified' })
+    expect(admitted).toEqual([SOURCE.provenance])
+  })
+})
+
+describe('deliveredFileProvenance', () => {
+  it('is clean for nothing delivered, and merges every admitted item’s entries', () => {
+    expect(deliveredFileProvenance([])).toEqual({ status: 'exact', entries: [] })
+    const other = { encryptedValue: 'ciphertext-2', sourceUserId: 'user-2' }
+    const merged = deliveredFileProvenance([
+      { status: 'exact', entries: [ENTRY] },
+      { status: 'exact', entries: [other] },
+      { status: 'exact', entries: [] },
+    ])
+    expect(merged.status).toBe('exact')
+    expect(merged.status === 'exact' && merged.entries).toEqual(
+      expect.arrayContaining([ENTRY, other])
+    )
+  })
+
+  it('stays unknown when any delivered item was unknown, and unrecorded when one was', () => {
+    expect(
+      deliveredFileProvenance([{ status: 'exact', entries: [ENTRY] }, { status: 'unknown' }])
+    ).toEqual({ status: 'unknown' })
+    expect(deliveredFileProvenance([{ status: 'unrecorded' }]).status).toBe('unrecorded')
+  })
+
+  it('reads an entry with no owner as unknown, since it cannot be re-bound to a file', () => {
+    expect(
+      deliveredFileProvenance([{ status: 'exact', entries: [{ encryptedValue: 'ciphertext-3' }] }])
+    ).toEqual({ status: 'unknown' })
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.ts b/apps/sim/lib/mothership/content-delivery/dispatch.ts
new file mode 100644
index 00000000000..9ded6bad23e
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.ts
@@ -0,0 +1,51 @@
+import {
+  type ContentDeliveryGate,
+  type ContentProvenance,
+  observeContentDelivery,
+  trackContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import {
+  mergeWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { parseWorkspaceFileSecretProvenance } from '@/lib/uploads/upload-session/workspace-file-provenance'
+import { v2Error } from '@/app/api/v2/lib/response'
+
+const UNCLASSIFIED_CONTENT_MESSAGE =
+  'This result cannot be returned to Chat because its content was not checked for secret values.'
+
+/**
+ * Dispatches one Chat request under `gate`, whatever its method. A successful response from an
+ * operation declared to return stored content that never classified it is replaced by a `403`, so
+ * a route that forgets to report its content fails closed instead of passing it to a model. A
+ * failure of the gate itself is rethrown, for the transport to answer.
+ */
+export async function dispatchUnderContentGate(
+  gate: ContentDeliveryGate,
+  dispatch: () => Promise<Response>
+): Promise<{ response: Response; admitted: readonly ContentProvenance[] }> {
+  const record = await observeContentDelivery(gate, () => trackContentDelivery(dispatch))
+  /**
+   * A gate that failed to decide is the transport's to answer, not the route's: the route mapped
+   * it to a generic error, and a write it interrupted may already have committed.
+   */
+  if (record.gateFailure !== undefined) {
+    await record.result.body?.cancel().catch(() => {})
+    throw record.gateFailure
+  }
+  if (record.unaccounted && record.result.ok) {
+    await record.result.body?.cancel().catch(() => {})
+    return { response: v2Error('FORBIDDEN', UNCLASSIFIED_CONTENT_MESSAGE), admitted: [] }
+  }
+  return { response: record.result, admitted: record.admitted }
+}
+
+/**
+ * The classification a persisted copy of the delivered bytes keeps. An entry with no owner cannot
+ * be re-bound to a file, so it reads as unknown rather than as clean.
+ */
+export function deliveredFileProvenance(
+  admitted: readonly ContentProvenance[]
+): WorkspaceFileSecretProvenance {
+  return mergeWorkspaceFileSecretProvenance(...admitted.map(parseWorkspaceFileSecretProvenance))
+}
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
new file mode 100644
index 00000000000..23ee267fa98
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -0,0 +1,153 @@
+/**
+ * @vitest-environment node
+ */
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+const telemetry = vi.hoisted(() => ({
+  reportDurableSecretProvenanceRefusal: vi.fn(),
+  reportDurableSecretProvenanceUnrecordedBatch: vi.fn(),
+}))
+vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
+
+import type { ContentProvenance, ContentSource } from '@/lib/core/application/content-delivery'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/** Ciphertext is `enc:<plaintext>`; `enc:` alone stands for a value whose key was rotated away. */
+const SECRET = 'SYNTHETIC_GATE_SECRET_4F7'
+const OTHER_SECRET = 'SYNTHETIC_OTHER_SECRET_9C2'
+
+function exact(...plaintexts: string[]): ContentProvenance {
+  return {
+    status: 'exact',
+    entries: plaintexts.map((plaintext) => ({
+      encryptedValue: `enc:${plaintext}`,
+      sourceUserId: 'user-1',
+      sourceWorkspaceId: 'workspace-1',
+      name: 'FIXTURE_TOKEN',
+    })),
+  }
+}
+
+function item(
+  id: string,
+  provenance: ContentProvenance,
+  view: ContentSource['view'] = 'complete'
+): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view }
+}
+
+function newRegistry() {
+  return new ResolvedSecretTraceRegistry([], { userId: 'user-1', workspaceId: 'workspace-1' })
+}
+
+/** What Chat's model receives for `text` under `registry`, as egress projects it. */
+function modelView(text: string, registry: ResolvedSecretTraceRegistry) {
+  const projection = projectResolvedSecretModelContent(text, registry.forkForPropagatedEntries())
+  return projection.safe ? projection.value : undefined
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => {
+    const plaintext = value.slice('enc:'.length)
+    if (!plaintext) throw new Error('decryption failed')
+    return { decrypted: plaintext }
+  })
+})
+
+describe('createRegistryContentGate', () => {
+  it('admits clean and unrecorded items, reporting the unrecorded ones once per batch', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({
+      registry,
+      workspaceId: 'workspace-1',
+      actorUserId: 'user-1',
+    })
+    const verdicts = await gate.admit([
+      item('clean', { status: 'exact', entries: [] }),
+      item('untracked', { status: 'unrecorded' }, 'opaque'),
+    ])
+    expect(verdicts).toEqual([true, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledTimes(1)
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledWith([
+      expect.objectContaining({ resourceId: 'untracked', surface: 'workspace-file' }),
+    ])
+  })
+
+  it('imports a complete item’s secrets so egress redacts them', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET))])).toEqual([true])
+    const view = modelView(`token=${SECRET}`, registry)
+    expect(view).toBeDefined()
+    expect(view).not.toContain(SECRET)
+    expect(view).toContain('{{FIXTURE_TOKEN}}')
+  })
+
+  it('imports only the secrets a derived view contains', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const derived = { excerpt: `token=${SECRET}` }
+    expect(await gate.admit([item('config', exact(SECRET, OTHER_SECRET), { derived })])).toEqual([
+      true,
+    ])
+    expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
+    /** The other secret is not in what this result shows, so it is not activated by it. */
+    expect(modelView(`other=${OTHER_SECRET}`, registry)).toContain(OTHER_SECRET)
+  })
+
+  it('refuses an opaque view of an item holding secrets, which no redaction reaches', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('archive', exact(SECRET), 'opaque')])).toEqual([false])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(telemetry.reportDurableSecretProvenanceRefusal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        resourceId: 'archive',
+        cause: 'workspace-file-opaque-secret-content',
+      })
+    )
+  })
+
+  it('refuses an item holding secrets when there is no registry to redact with', async () => {
+    const gate = createRegistryContentGate({ actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET))])).toEqual([false])
+  })
+
+  it('refuses an unknown item without latching the registry', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+  })
+
+  it('admits an unknown item under taint and withholds the whole output instead (D7)', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1', unknown: 'taint' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([true])
+    expect(registry.isPermanentlyIncomplete()).toBe(true)
+    expect(modelView('anything at all', registry)).toBeUndefined()
+  })
+
+  it('refuses only the item whose secrets cannot be imported, keeping the rest of the call', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const rotated: ContentProvenance = {
+      status: 'exact',
+      entries: [{ encryptedValue: 'enc:', sourceUserId: 'user-1', name: 'ROTATED' }],
+    }
+    const verdicts = await gate.admit([
+      item('rotated', rotated),
+      item('config', exact(SECRET)),
+      item('clean', { status: 'exact', entries: [] }),
+    ])
+    expect(verdicts).toEqual([false, true, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
new file mode 100644
index 00000000000..d20d2ccf724
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -0,0 +1,83 @@
+import type { ContentDeliveryGate, ContentSource } from '@/lib/core/application/content-delivery'
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  type DurableSecretProvenanceUnrecordedReport,
+  reportDurableSecretProvenanceUnrecordedBatch,
+} from '@/lib/execution/durable-secret-provenance-telemetry'
+import {
+  CONTENT_SURFACE,
+  type ContentRefusalReason,
+  reportContentRefusal,
+} from '@/lib/mothership/content-delivery/telemetry'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+export interface RegistryContentGateScope {
+  /** The registry whose projection is the output Chat's model receives. */
+  registry?: ResolvedSecretTraceRegistry
+  workspaceId?: string
+  organizationId?: string
+  actorUserId: string
+  /**
+   * `taint` admits an unknown item and latches the registry, so the whole output is withheld and
+   * anything persisted from it stays unknown. Only a direct single-file download takes it (D7).
+   */
+  unknown?: 'refuse' | 'taint'
+}
+
+/**
+ * Decides items against a model registry: an item's exact secrets are imported so egress redacts
+ * them. Each item is first imported into a throwaway registry, so an item whose secrets cannot be
+ * imported is refused on its own instead of latching the registry for every other item.
+ */
+export function createRegistryContentGate(scope: RegistryContentGateScope): ContentDeliveryGate {
+  const refuse = (source: ContentSource, reason: ContentRefusalReason): false =>
+    reportContentRefusal(source, reason, scope.workspaceId)
+
+  const decide = async (
+    source: ContentSource,
+    unrecorded: DurableSecretProvenanceUnrecordedReport[]
+  ): Promise<boolean> => {
+    const { provenance } = source
+    if (provenance.status === 'unknown') {
+      if (scope.unknown !== 'taint') return refuse(source, 'unknown')
+      scope.registry?.markIncomplete('workspace-file-provenance-unknown')
+      return true
+    }
+    if (provenance.status === 'unrecorded') {
+      unrecorded.push({
+        surface: CONTENT_SURFACE[source.kind],
+        workspaceId: scope.workspaceId,
+        organizationId: scope.organizationId,
+        resourceId: source.id,
+        actorUserId: scope.actorUserId,
+      })
+      return true
+    }
+    if (provenance.entries.length === 0) return true
+    if (source.view === 'opaque') return refuse(source, 'opaque')
+    const registry = scope.registry
+    if (!registry) return refuse(source, 'registry')
+    const value = typeof source.view === 'object' ? source.view.derived : undefined
+    const staged = new ResolvedSecretTraceRegistry([], undefined, { staged: true })
+    if (!(await importDurableSecretProvenance(staged, provenance, value))) {
+      return refuse(source, 'import')
+    }
+    /**
+     * The staged import proved every entry decrypts, so this one only activates them. Its result
+     * also reflects whether the registry was already incomplete for another reason; that output is
+     * withheld anyway, so this item is not refused for it.
+     */
+    await importDurableSecretProvenance(registry, provenance, value)
+    return true
+  }
+
+  return {
+    async admit(sources) {
+      const unrecorded: DurableSecretProvenanceUnrecordedReport[] = []
+      const verdicts: boolean[] = []
+      for (const source of sources) verdicts.push(await decide(source, unrecorded))
+      reportDurableSecretProvenanceUnrecordedBatch(unrecorded)
+      return verdicts
+    },
+  }
+}
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
new file mode 100644
index 00000000000..022750b45a9
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
@@ -0,0 +1,84 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/** The workbench history lives in Redis beside a remote machine; only its write is observed. */
+const history = vi.hoisted(() => ({ recordExistingSessionFileInput: vi.fn() }))
+vi.mock('@/lib/execution/remote-sandbox/session-file-provenance', () => history)
+const telemetry = vi.hoisted(() => ({
+  reportDurableSecretProvenanceRefusal: vi.fn(),
+  reportDurableSecretProvenanceUnrecordedBatch: vi.fn(),
+}))
+vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
+
+import type { ContentProvenance, ContentSource } from '@/lib/core/application/content-delivery'
+import {
+  createSessionContentGate,
+  WorkbenchProvenanceUnavailableError,
+} from '@/lib/mothership/content-delivery/session-gate'
+
+const ENTRY = {
+  encryptedValue: 'ciphertext-1',
+  sourceUserId: 'user-1',
+  sourceWorkspaceId: 'workspace-1',
+  name: 'FIXTURE_TOKEN',
+}
+
+function item(id: string, provenance: ContentProvenance): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view: 'opaque' }
+}
+
+const gate = () =>
+  createSessionContentGate({
+    sessionKey: 'session-1',
+    workspaceId: 'workspace-1',
+    actorUserId: 'user-1',
+  })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  history.recordExistingSessionFileInput.mockResolvedValue(undefined)
+})
+
+describe('createSessionContentGate', () => {
+  it('keeps an unknown item out of the machine and its history', async () => {
+    expect(await gate().admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+    expect(history.recordExistingSessionFileInput).not.toHaveBeenCalled()
+    expect(telemetry.reportDurableSecretProvenanceRefusal).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: 'tainted' })
+    )
+  })
+
+  it('admits secret-bearing bytes, even opaque, after merging their entries into the history', async () => {
+    const verdicts = await gate().admit([
+      item('config', { status: 'exact', entries: [ENTRY] }),
+      item('tainted', { status: 'unknown' }),
+      item('clean', { status: 'exact', entries: [] }),
+    ])
+    expect(verdicts).toEqual([true, false, true])
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledTimes(1)
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledWith('session-1', {
+      status: 'exact',
+      entries: [ENTRY],
+    })
+  })
+
+  it('records an unrecorded item as clean history and reports the absence', async () => {
+    expect(await gate().admit([item('untracked', { status: 'unrecorded' })])).toEqual([true])
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledWith('session-1', {
+      status: 'exact',
+      entries: [],
+    })
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledWith([
+      expect.objectContaining({ recordCount: 1, workspaceId: 'workspace-1' }),
+    ])
+  })
+
+  it('lets nothing in when the history cannot be widened', async () => {
+    history.recordExistingSessionFileInput.mockRejectedValue(new Error('redis unavailable'))
+    await expect(
+      gate().admit([item('clean', { status: 'exact', entries: [] })])
+    ).rejects.toBeInstanceOf(WorkbenchProvenanceUnavailableError)
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.ts b/apps/sim/lib/mothership/content-delivery/session-gate.ts
new file mode 100644
index 00000000000..f8198720631
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.ts
@@ -0,0 +1,72 @@
+import type { ContentDeliveryGate } from '@/lib/core/application/content-delivery'
+import {
+  type DurableSecretProvenance,
+  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
+  mergeDurableSecretProvenance,
+} from '@/lib/execution/durable-secret-provenance'
+import { reportDurableSecretProvenanceUnrecordedBatch } from '@/lib/execution/durable-secret-provenance-telemetry'
+import { recordExistingSessionFileInput } from '@/lib/execution/remote-sandbox/session-file-provenance'
+import { reportContentRefusal } from '@/lib/mothership/content-delivery/telemetry'
+
+/** The workbench's history could not be widened, so nothing may enter the machine. */
+export class WorkbenchProvenanceUnavailableError extends Error {
+  constructor(cause: unknown) {
+    super('Workbench secret provenance could not be recorded', { cause })
+    this.name = 'WorkbenchProvenanceUnavailableError'
+  }
+}
+
+/**
+ * Decides items entering run_code's workbench. An unknown item never enters the machine, so the
+ * machine's history stays exact and one tainted file cannot withhold every later run in the chat.
+ * Everything admitted is merged into the history before its bytes are returned, which is what keeps
+ * files the machine later derives from it carrying its secrets.
+ */
+export function createSessionContentGate(scope: {
+  sessionKey: string
+  workspaceId: string
+  actorUserId: string
+}): ContentDeliveryGate {
+  return {
+    async admit(sources) {
+      const verdicts: boolean[] = []
+      const admitted: DurableSecretProvenance[] = []
+      let unrecorded = 0
+      for (const source of sources) {
+        const { provenance } = source
+        if (provenance.status === 'unknown') {
+          verdicts.push(reportContentRefusal(source, 'unknown', scope.workspaceId))
+          continue
+        }
+        if (provenance.status === 'unrecorded') {
+          unrecorded += 1
+          admitted.push(EXACT_EMPTY_DURABLE_SECRET_PROVENANCE)
+        } else {
+          admitted.push(provenance)
+        }
+        verdicts.push(true)
+      }
+      if (admitted.length > 0) {
+        try {
+          await recordExistingSessionFileInput(
+            scope.sessionKey,
+            mergeDurableSecretProvenance(...admitted)
+          )
+        } catch (error) {
+          throw new WorkbenchProvenanceUnavailableError(error)
+        }
+      }
+      if (unrecorded > 0) {
+        reportDurableSecretProvenanceUnrecordedBatch([
+          {
+            surface: 'workspace-file',
+            workspaceId: scope.workspaceId,
+            actorUserId: scope.actorUserId,
+            recordCount: unrecorded,
+          },
+        ])
+      }
+      return verdicts
+    },
+  }
+}
diff --git a/apps/sim/lib/mothership/content-delivery/telemetry.ts b/apps/sim/lib/mothership/content-delivery/telemetry.ts
new file mode 100644
index 00000000000..fce1cf6a334
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/telemetry.ts
@@ -0,0 +1,64 @@
+import type { ContentSource, ContentSourceKind } from '@/lib/core/application/content-delivery'
+import {
+  type DurableSecretProvenanceRefusalCause,
+  type DurableSecretProvenanceSurface,
+  reportDurableSecretProvenanceRefusal,
+} from '@/lib/execution/durable-secret-provenance-telemetry'
+
+export type ContentRefusalReason = 'unknown' | 'opaque' | 'registry' | 'import'
+
+export const CONTENT_SURFACE: Record<ContentSourceKind, DurableSecretProvenanceSurface> = {
+  'workspace-file': 'workspace-file',
+  'execution-file': 'workspace-file',
+  'knowledge-document': 'knowledge',
+  'knowledge-chunk': 'knowledge',
+  'table-row': 'table-row',
+}
+
+const FILE_CAUSES: Record<ContentRefusalReason, DurableSecretProvenanceRefusalCause> = {
+  unknown: 'workspace-file-provenance-unavailable',
+  opaque: 'workspace-file-opaque-secret-content',
+  registry: 'workspace-file-registry-unavailable',
+  import: 'workspace-file-provenance-unavailable',
+}
+
+const CAUSES: Record<
+  ContentSourceKind,
+  Record<ContentRefusalReason, DurableSecretProvenanceRefusalCause>
+> = {
+  'workspace-file': FILE_CAUSES,
+  'execution-file': FILE_CAUSES,
+  'knowledge-document': {
+    unknown: 'knowledge-document-source-unavailable',
+    opaque: 'knowledge-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'knowledge-result-provenance-unavailable',
+  },
+  'knowledge-chunk': {
+    unknown: 'knowledge-chunk-source-unavailable',
+    opaque: 'knowledge-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'knowledge-result-provenance-unavailable',
+  },
+  'table-row': {
+    unknown: 'table-row-provenance-unavailable',
+    opaque: 'table-row-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'table-row-provenance-unavailable',
+  },
+}
+
+/** Names the refused item and why, never its content. */
+export function reportContentRefusal(
+  source: ContentSource,
+  reason: ContentRefusalReason,
+  workspaceId: string | undefined
+): false {
+  reportDurableSecretProvenanceRefusal({
+    surface: CONTENT_SURFACE[source.kind],
+    cause: CAUSES[source.kind][reason],
+    workspaceId,
+    resourceId: source.id,
+  })
+  return false
+}
diff --git a/apps/sim/lib/mothership/integrations/application/catalog.ts b/apps/sim/lib/mothership/integrations/application/catalog.ts
index f014f55f932..ab3022c379e 100644
--- a/apps/sim/lib/mothership/integrations/application/catalog.ts
+++ b/apps/sim/lib/mothership/integrations/application/catalog.ts
@@ -39,6 +39,7 @@ export const readIntegrationCatalogOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot', 'executor'],
 })
@@ -130,6 +131,7 @@ const catalogUseCase = defineAuthorizedChatUseCase({
   operation: readIntegrationCatalogOperation,
   organizationOperation: defineOrganizationOperation({
     id: readIntegrationCatalogOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/request/application/read-control.ts b/apps/sim/lib/mothership/request/application/read-control.ts
index c8984964af0..b882ca60fd5 100644
--- a/apps/sim/lib/mothership/request/application/read-control.ts
+++ b/apps/sim/lib/mothership/request/application/read-control.ts
@@ -14,6 +14,7 @@ export const readRunControlOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
@@ -23,6 +24,7 @@ export const readRunControl = defineAuthorizedChatUseCase({
   /** permission-group-exempt: observing Stop must remain available after Assistant access is withheld. */
   organizationOperation: defineOrganizationOperation({
     id: readRunControlOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: readRunControlOperation.capability,
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/tasks/application/operations.ts b/apps/sim/lib/mothership/tasks/application/operations.ts
index ae44b3e45e1..1bd995576a2 100644
--- a/apps/sim/lib/mothership/tasks/application/operations.ts
+++ b/apps/sim/lib/mothership/tasks/application/operations.ts
@@ -21,11 +21,13 @@ export const taskOperations = {
     id: 'mothership.tasks.workflow_status',
     ...taskPrincipalPolicy,
     capability: 'copilot.use',
+    contentDelivery: 'none',
   }),
   wake: defineWorkspaceOperation({
     id: 'mothership.tasks.wake',
     ...taskPrincipalPolicy,
     capability: 'copilot.use',
+    contentDelivery: 'none',
   }),
 } as const
 
@@ -38,6 +40,7 @@ export const organizationTaskOperations = {
   }),
   readWorkflowStatus: defineOrganizationOperation({
     id: taskOperations.readWorkflowStatus.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
@@ -46,6 +49,7 @@ export const organizationTaskOperations = {
   }),
   wake: defineOrganizationOperation({
     id: taskOperations.wake.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/tool-executor/executor.ts b/apps/sim/lib/mothership/tool-executor/executor.ts
index 0d0c6986fb2..753c0b6ab16 100644
--- a/apps/sim/lib/mothership/tool-executor/executor.ts
+++ b/apps/sim/lib/mothership/tool-executor/executor.ts
@@ -1,10 +1,12 @@
 import { createLogger } from '@sim/logger'
 import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
 import { toError } from '@sim/utils/errors'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import { ASSISTANT_TOOLS, isAssistantIntegrationTool } from '@/lib/mothership/assistant/tool-policy'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
 import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import { projectToolErrorMessageForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
@@ -196,6 +198,26 @@ async function executeBoundTool(
     }
   }
 
+  /**
+   * Every stored item a Sim-side tool returns to Chat — through a use case it calls directly, or
+   * through the CLI it runs — is admitted against this call's registry, so its secrets are redacted
+   * from the result and an unknown item is refused on its own.
+   */
+  const gate = createRegistryContentGate({
+    registry: context.resolvedSecretTraceRegistry,
+    workspaceId: context.workspaceId,
+    organizationId: context.chatOrganizationId ?? context.organizationId,
+    actorUserId: context.userId,
+  })
+  return observeContentDelivery(gate, () => executeGatedTool(toolId, params, context))
+}
+
+async function executeGatedTool(
+  toolId: string,
+  params: Record<string, unknown>,
+  context: ToolExecutionContext
+): Promise<ToolExecutionResult> {
+  const usesHeadlessClientFallback = isClientExecuted(toolId) && hasHandler(toolId)
   return withResourceOutboundScope(context, async () => {
     const canUseRegisteredHandler =
       hasHandler(toolId) &&
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
index d940ef76062..93dd7f42faf 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
@@ -34,7 +34,9 @@ vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/tools', () => toolsMock)
 
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import type { ToolExecutionContext } from '@/lib/mothership/tool-executor/types'
 import {
@@ -99,17 +101,46 @@ function queueProvenance(status: 'exact' | 'unknown', currentRevision = revision
   ])
 }
 
-function run(
+/** Resolves inputs under the gate `run_code` installs over the run's own registry. */
+function resolveGated(
+  registry: ResolvedSecretTraceRegistry,
+  ...args: Parameters<typeof resolveInputFiles>
+) {
+  const [mountContext] = args
+  return observeContentDelivery(
+    createRegistryContentGate({
+      registry,
+      workspaceId: mountContext.workspaceId,
+      organizationId: mountContext.chatOrganizationId ?? mountContext.organizationId,
+      actorUserId: mountContext.userId,
+    }),
+    () => resolveInputFiles(...args)
+  )
+}
+
+function resolve(
   trace = new ResolvedSecretTraceRegistry([], { userId: 'reader', workspaceId: 'workspace' }),
   overrides: Partial<ToolExecutionContext> = {}
 ) {
-  return resolveInputFiles(
-    { ...context, ...overrides },
-    [{ path: 'file', sandboxPath: '/tmp/source.txt' }],
-    undefined,
-    undefined,
-    trace
-  )
+  return resolveGated(trace, { ...context, ...overrides }, [
+    { path: 'file', sandboxPath: '/tmp/source.txt' },
+  ])
+}
+
+async function run(...args: Parameters<typeof resolve>) {
+  const { files, excluded } = await resolve(...args)
+  expect(excluded).toEqual([])
+  return files
+}
+
+/** A file the gate refuses is left out on its own, before any byte or URL is acquired. */
+async function expectExcluded(...args: Parameters<typeof resolve>) {
+  const { files, excluded } = await resolve(...args)
+  expect(files).toEqual([])
+  expect(excluded).toEqual([{ path: '/tmp/source.txt', reason: expect.any(String) }])
+  expect(mocks.buffer).not.toHaveBeenCalled()
+  expect(mocks.presign).not.toHaveBeenCalled()
+  expect(mocks.render).not.toHaveBeenCalled()
 }
 
 function mountedBytes(mounts: SandboxFile[]) {
@@ -167,14 +198,9 @@ describe('Mothership file mounts bind content and classification to the same rec
       userId: 'reader',
       workspaceId: 'workspace',
     })
-    const mounts = await run(trace)
-    expect(mountedBytes(mounts).toString()).toBe(content)
-    const observation = inspectToolResultForCopilot(
-      { success: true, output: content },
-      trace,
-      'run_code'
-    )
-    expect(JSON.stringify(observation.result)).not.toContain(content)
+    await expectExcluded(trace)
+    /** Leaving the file out keeps the run's registry, and every later run in the chat, intact. */
+    expect(trace.isComplete()).toBe(true)
   })
 
   it.each(['safe', 'secret', 'unknown'] as const)(
@@ -185,6 +211,10 @@ describe('Mothership file mounts bind content and classification to the same rec
         userId: 'reader',
         workspaceId: 'workspace',
       })
+      if (kind === 'unknown') {
+        await expectExcluded(trace)
+        return
+      }
       expect(mountedBytes(await run(trace)).toString()).toBe(content)
       const observation = inspectToolResultForCopilot(
         { success: true, output: content },
@@ -197,9 +227,9 @@ describe('Mothership file mounts bind content and classification to the same rec
 
   /**
    * The run's code can read every mounted byte, so the per-call registry the Copilot projection
-   * and output-file writers read must carry the mount's own verdict across the crossing: a
-   * tainted mount stays a taint (never the `unrecorded` absence) and names the guard that tripped,
-   * while exact mounts keep redacting and clean mounts stay readable.
+   * and output-file writers read must carry the mount's own verdict across the crossing: exact
+   * mounts keep redacting and clean mounts stay readable, while an unknown file never enters the
+   * runtime and the output names it as left out.
    */
   it.each(['safe', 'secret', 'unknown'] as const)(
     'carries a %s mount verdict across the run_code crossing',
@@ -222,51 +252,44 @@ describe('Mothership file mounts bind content and classification to the same rec
         { ...context, resolvedSecretTraceRegistry: trace }
       )
 
+      if (kind === 'unknown') {
+        expect(toolsMockFns.mockExecuteTool.mock.calls[0]?.[1]?._sandboxFiles).toBeUndefined()
+        expect(mocks.buffer).not.toHaveBeenCalled()
+        expect(result.output).toMatchObject({
+          excludedInputs: [{ path: '/tmp/source.txt', reason: expect.any(String) }],
+        })
+        return
+      }
       const observation = inspectToolResultForCopilot(result, trace, 'run_code')
       const written = await createWorkspaceFileSecretProvenanceFromRegistry(trace, result.output, {
         userId: 'reader',
         workspaceId: 'workspace',
       })
       expect(JSON.stringify(observation.result).includes(content)).toBe(kind === 'safe')
-      if (kind === 'unknown') {
-        expect(observation.safe).toBe(false)
-        expect.soft(observation.safe ? undefined : observation.cause).toMatchObject({
-          kind: 'registry-incomplete',
-          reasons: expect.arrayContaining(['mounted-file-provenance-unavailable']),
-        })
-        expect.soft(written).toEqual({ safe: false })
-        expect(observation.result.output).toEqual({
-          resultWithheld: true,
-          withheldReason: expect.stringMatching(
-            /file, table, or document .* unknown secret provenance/
-          ),
-        })
-      } else {
-        expect(observation.safe).toBe(true)
-        expect(written).toMatchObject({
-          safe: true,
-          provenance: {
-            status: 'exact',
-            // A mounted file's secret crosses anonymously: its ciphertext binds it, not a name.
-            entries:
-              kind === 'secret'
-                ? [
-                    {
-                      encryptedValue: 'fixture-ciphertext',
-                      sourceUserId: 'reader',
-                      sourceWorkspaceId: 'workspace',
-                    },
-                  ]
-                : [],
-          },
-        })
-      }
+      expect(observation.safe).toBe(true)
+      expect(written).toMatchObject({
+        safe: true,
+        provenance: {
+          status: 'exact',
+          // A mounted file's secret crosses anonymously: its ciphertext binds it, not a name.
+          entries:
+            kind === 'secret'
+              ? [
+                  {
+                    encryptedValue: 'fixture-ciphertext',
+                    sourceUserId: 'reader',
+                    sourceWorkspaceId: 'workspace',
+                  },
+                ]
+              : [],
+        },
+      })
     }
   )
 
   it('denies revoked access before content or signed URL acquisition', async () => {
     mocks.permission.mockResolvedValue(null)
-    await expect(run()).rejects.toThrow('permissions')
+    await expect(resolve()).rejects.toThrow('permissions')
     expect(mocks.file).not.toHaveBeenCalled()
     expect(mocks.buffer).not.toHaveBeenCalled()
     expect(mocks.presign).not.toHaveBeenCalled()
@@ -294,36 +317,28 @@ describe('Mothership file mounts bind content and classification to the same rec
     expect(mocks.buffer).not.toHaveBeenCalled()
   })
 
-  it.each(['missing revision', 'sidecar outage'])(
-    'withholds model output on %s without discarding runtime bytes',
-    async (failure) => {
-      if (failure === 'missing revision')
-        mocks.file.mockResolvedValue({ ...file, contentUpdatedAt: null })
-      else dbChainMockFns.limit.mockRejectedValueOnce(new Error('Classification unavailable'))
-      const trace = new ResolvedSecretTraceRegistry([], {
-        userId: 'reader',
-        workspaceId: 'workspace',
-      })
-      expect(mountedBytes(await run(trace)).toString()).toBe(content)
-      expect(trace.isPermanentlyIncomplete()).toBe(true)
-      expect(
-        JSON.stringify(
-          inspectToolResultForCopilot({ success: true, output: content }, trace, 'run_code').result
-        )
-      ).not.toContain(content)
-    }
-  )
-
-  it('does not use a newer sidecar to certify a signed mount either', async () => {
-    mocks.cloud.mockReturnValue(true)
-    queueProvenance('exact', new Date(revision.getTime() + 1))
+  it('leaves out a file whose revision is missing, without touching the run registry', async () => {
+    mocks.file.mockResolvedValue({ ...file, contentUpdatedAt: null })
     const trace = new ResolvedSecretTraceRegistry([], {
       userId: 'reader',
       workspaceId: 'workspace',
     })
-    const mounts = await run(trace)
-    expect(mounts[0]).toMatchObject({ type: 'url' })
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
+    await expectExcluded(trace)
+    expect(trace.isComplete()).toBe(true)
+  })
+
+  /** An outage is not a verdict: the run fails, retryable, before any byte is read. */
+  it('fails the mount on a classification outage before reading bytes', async () => {
+    dbChainMockFns.limit.mockRejectedValueOnce(new Error('Classification unavailable'))
+    await expect(resolve()).rejects.toThrow('Classification unavailable')
+    expect(mocks.buffer).not.toHaveBeenCalled()
+    expect(mocks.presign).not.toHaveBeenCalled()
+  })
+
+  it('does not use a newer sidecar to certify a signed mount either', async () => {
+    mocks.cloud.mockReturnValue(true)
+    queueProvenance('exact', new Date(revision.getTime() + 1))
+    await expectExcluded()
   })
 
   it('renders generated documents with the acting principal and retains the rendered bytes', async () => {
@@ -346,7 +361,7 @@ describe('Mothership file mounts bind content and classification to the same rec
   it('stops before acquiring a mount when the tool was already aborted', async () => {
     const controller = new AbortController()
     controller.abort(new Error('Stopped'))
-    await expect(run(undefined, { abortSignal: controller.signal })).rejects.toThrow('Stopped')
+    await expect(resolve(undefined, { abortSignal: controller.signal })).rejects.toThrow('Stopped')
     expect(mocks.context).not.toHaveBeenCalled()
     expect(mocks.buffer).not.toHaveBeenCalled()
     expect(mocks.presign).not.toHaveBeenCalled()
@@ -354,15 +369,15 @@ describe('Mothership file mounts bind content and classification to the same rec
 
   it('does not hand completed bytes to the runtime after Stop during their read', async () => {
     const controller = new AbortController()
+    queueProvenance('exact')
     mocks.buffer.mockImplementation(async () => {
       controller.abort(new Error('Stopped during read'))
       return Buffer.from(content)
     })
-    await expect(run(undefined, { abortSignal: controller.signal })).rejects.toThrow(
+    await expect(resolve(undefined, { abortSignal: controller.signal })).rejects.toThrow(
       'Stopped during read'
     )
     expect(mocks.buffer).toHaveBeenCalledTimes(1)
-    expect(dbChainMockFns.select).not.toHaveBeenCalled()
   })
 
   it('does not charge the supplied mount budget when byte acquisition fails', async () => {
@@ -396,7 +411,8 @@ describe('organization-owned upload mounts', () => {
   })
   it('mounts the exact authorized private chat upload with no workspace lookup', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
-    const result = await resolveInputFiles(
+    const result = await resolveGated(
+      registry,
       {
         ...context,
         workspaceId: undefined,
@@ -405,10 +421,10 @@ describe('organization-owned upload mounts', () => {
       },
       [{ path: 'uploads/upload', sandboxPath: '/tmp/input.txt' }],
       [],
-      [],
-      registry
+      []
     )
-    expect(result).toEqual([
+    expect(result.excluded).toEqual([])
+    expect(result.files).toEqual([
       {
         path: '/tmp/input.txt',
         content: Buffer.from('public input').toString('base64'),
@@ -445,7 +461,8 @@ describe('organization-owned upload mounts', () => {
         )
       }
       const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
-      const result = await resolveInputFiles(
+      const result = await resolveGated(
+        registry,
         {
           ...context,
           workspaceId: undefined,
@@ -454,10 +471,9 @@ describe('organization-owned upload mounts', () => {
         },
         [{ path: 'uploads/upload', sandboxPath: '/tmp/input.txt' }],
         [],
-        [],
-        registry
+        []
       )
-      expect(result).toEqual([
+      expect(result.files).toEqual([
         {
           path: '/tmp/input.txt',
           content: Buffer.from('public input').toString('base64'),
@@ -470,7 +486,8 @@ describe('organization-owned upload mounts', () => {
   it('does not repair an existing protection fault when an intentional upload is mounted', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
     registry.markIncomplete('entry-decrypt-failed')
-    const result = await resolveInputFiles(
+    const result = await resolveGated(
+      registry,
       {
         ...context,
         workspaceId: undefined,
@@ -479,31 +496,30 @@ describe('organization-owned upload mounts', () => {
       },
       [{ path: 'uploads/upload' }],
       [],
-      [],
-      registry
+      []
     )
-    expect(result).toHaveLength(1)
+    expect(result.files).toHaveLength(1)
     expect(registry.isPermanentlyIncomplete()).toBe(true)
   })
   it('requires a target for workspace files and never treats missing upload authority as a workspace fallback', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
     await expect(
-      resolveInputFiles(
+      resolveGated(
+        registry,
         { ...context, workspaceId: undefined, organizationId: 'org' },
         [{ path: 'files/secret.txt' }],
         [],
-        [],
-        registry
+        []
       )
     ).rejects.toThrow('explicit workspace')
     mocks.attachment.mockRejectedValue(new Error('Attachment not found'))
     await expect(
-      resolveInputFiles(
+      resolveGated(
+        registry,
         { ...context, workspaceId: undefined, organizationId: 'org' },
         [{ path: 'uploads/foreign' }],
         [],
-        [],
-        registry
+        []
       )
     ).rejects.toThrow('Attachment not found')
     expect(mocks.find).not.toHaveBeenCalled()
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
index 97f3ae629c0..5aa726d90da 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
@@ -201,27 +201,24 @@ describe('Mothership table mounts through code calls', () => {
     expect(mocks.execute).not.toHaveBeenCalled()
   })
 
-  it('retains snapshot provenance refusal and cloud transport without buffering', async () => {
+  /**
+   * A snapshot whose rows hold a recorded secret, or lack vouched provenance, is opaque to
+   * redaction once mounted, so it is left out on its own and reported; the run itself proceeds.
+   */
+  it('excludes a table whose snapshot is unsafe for Chat, before any byte or URL is acquired', async () => {
     mocks.safety.mockResolvedValueOnce('stale')
     await expect(run('table-orders')).rejects.toThrow('changed while preparing')
     expect(mocks.presign).not.toHaveBeenCalled()
     mocks.cloud.mockReturnValue(true)
     mocks.safety.mockResolvedValue('unsafe-provenance')
-    await run('table-orders')
+    const result = await run('table-orders')
     const params = mocks.execute.mock.calls[0][1]
-    expect(params._sandboxFiles).toEqual([
-      {
-        type: 'url',
-        path: '/tmp/orders.csv',
-        url: 'https://storage.invalid/snapshot',
-        maxBytes: 500 * 1024 * 1024,
-      },
-    ])
-    expect(mocks.presign).toHaveBeenCalledWith('snapshot.csv', 'execution', 1800)
+    expect(params._sandboxFiles).toBeUndefined()
+    expect(mocks.presign).not.toHaveBeenCalled()
     expect(mocks.download).not.toHaveBeenCalled()
-    expect(
-      mocks.execute.mock.calls[0][2].resolvedSecretTraceRegistry.exportProvenance().complete
-    ).toBe(false)
+    expect(result.output).toMatchObject({
+      excludedInputs: [{ path: 'table-orders', reason: expect.any(String) }],
+    })
   })
 
   it.each(['local', 'cloud'] as const)(
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute.ts b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
index ce761b5e7d5..466731341dd 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
@@ -2,6 +2,10 @@ import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { omit, toRecord } from '@sim/utils/object'
 import { hasWorkspaceSandboxAccess } from '@/lib/billing/core/subscription'
+import {
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   durableSecretProvenanceFromEnvelope,
@@ -32,6 +36,7 @@ import { resolveCopilotFilePrincipal } from '@/lib/mothership/auth/file-delegati
 import { messageForCopilotTableError } from '@/lib/mothership/auth/table-delegation'
 import { recordServiceCost } from '@/lib/mothership/billing/service-observer'
 import { readChatAttachment } from '@/lib/mothership/chat/application/read-attachment'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { WorkbenchSecretNames } from '@/lib/mothership/generated/workbench'
 import { applySecretMountPolicy } from '@/lib/mothership/secret-mount-policy'
 import type {
@@ -52,7 +57,6 @@ import {
   parseChatUploadReference,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import { importWorkspaceFileSnapshotProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { decodeVfsPathSegments, encodeVfsPathSegments } from '@/lib/vfs/path'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import {
@@ -77,46 +81,47 @@ const MAX_MOUNTED_FILES = 500
 const DEFAULT_TIMEOUT_SECONDS = 60
 const MAX_TIMEOUT_SECONDS = 300
 
-/** Keeps mount bytes, canonical classification and budget together until they enter the runtime. */
+/** An input the run asked for that was not mounted, and why; paths are the model's own. */
+export interface ExcludedInput {
+  path: string
+  reason: string
+}
+
+const UNVERIFIED_INPUT_REASON =
+  'Its secret provenance could not be verified, so it was not mounted. Other inputs were mounted.'
+
+/**
+ * Mounts one file whose classification the installed gate admits. A file the gate refuses is left
+ * out on its own and reported, so one unknown file neither withholds the run's output nor enters
+ * the workbench's history, where it would withhold every later run in the chat.
+ */
 async function pushWorkspaceFileMount(
-  sandboxFiles: SandboxFile[],
+  mounts: ResolvedInputMounts,
   record: WorkspaceFileRecord,
   mountPath: string,
-  mounted: SandboxMountBudget,
   workspaceId: string,
   principal: Principal,
-  registry?: ResolvedSecretTraceRegistry,
   signal?: AbortSignal
 ): Promise<void> {
-  if (!registry) {
-    throw new Error(
-      `Input file "${mountPath}" cannot be mounted because its secret provenance is unavailable.`
-    )
-  }
-  const result = await readWorkspaceFileMount.execute({
-    principal,
-    input: {
-      fileId: record.id,
-      assertedWorkspaceId: workspaceId,
-      mountPath,
-      budget: mounted,
-      signal,
-    },
-  })
   try {
-    const imported = await importWorkspaceFileSnapshotProvenance({
-      workspaceId,
-      provenance: result.secretProvenance,
-      resourceId: record.id,
-      registry,
+    const result = await readWorkspaceFileMount.execute({
+      principal,
+      input: {
+        fileId: record.id,
+        assertedWorkspaceId: workspaceId,
+        mountPath,
+        budget: mounts.budget,
+        signal,
+      },
     })
-    if (!imported) registry.markIncomplete('mounted-file-provenance-unavailable')
-  } catch {
-    registry.markIncomplete('mounted-file-provenance-unavailable')
+    signal?.throwIfAborted()
+    mounts.files.push(result.mount)
+    Object.assign(mounts.budget, result.budget)
+  } catch (error) {
+    if (!(error instanceof ContentRefusedError)) throw error
+    signal?.throwIfAborted()
+    mounts.excluded.push({ path: mountPath, reason: UNVERIFIED_INPUT_REASON })
   }
-  signal?.throwIfAborted()
-  sandboxFiles.push(result.mount)
-  Object.assign(mounted, result.budget)
 }
 
 /**
@@ -226,13 +231,24 @@ async function resolveMountableWorkspaceFile(
   )
 }
 
+/** The inputs a run mounts, those it left out, and the mount budget they spent. */
+interface ResolvedInputMounts {
+  files: SandboxFile[]
+  excluded: ExcludedInput[]
+  budget: SandboxMountBudget
+}
+
+/**
+ * Resolves a run's file, directory and table inputs into mounts. Every stored item is decided by
+ * the gate the caller installed, so the run's registry learns each mounted file's secrets and a
+ * refused item is reported rather than mounted.
+ */
 export async function resolveInputFiles(
   context: ToolExecutionContext,
   inputFiles?: unknown[],
   inputTables?: unknown[],
-  inputDirectories?: unknown[],
-  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
-): Promise<SandboxFile[]> {
+  inputDirectories?: unknown[]
+): Promise<{ files: SandboxFile[]; excluded: ExcludedInput[] }> {
   const workspaceId = context.workspaceId
   if ((inputFiles?.length ?? 0) > MAX_MOUNTED_FILES) throw new Error('Too many input files')
   const organizationId = context.chatOrganizationId ?? context.organizationId
@@ -286,15 +302,18 @@ export async function resolveInputFiles(
   if (!workspaceId) {
     if (inputFiles?.length || inputTables?.length || inputDirectories?.length)
       throw new Error('An explicit workspace is required for workspace input mounts')
-    return attachments
+    return { files: attachments, excluded: [] }
   }
   const filePrincipal =
     inputFiles?.length || inputDirectories?.length
       ? resolveCopilotFilePrincipal(context)
       : undefined
-  const sandboxFiles: SandboxFile[] = [...attachments]
-  const mounted = createSandboxMountBudget()
-  mounted.buffered = attachments.reduce(
+  const mounts: ResolvedInputMounts = {
+    files: [...attachments],
+    excluded: [],
+    budget: createSandboxMountBudget(),
+  }
+  mounts.budget.buffered = attachments.reduce(
     (total, file) => total + ('content' in file ? Buffer.byteLength(file.content, 'base64') : 0),
     0
   )
@@ -326,13 +345,11 @@ export async function resolveInputFiles(
       )
       const mountPath = refField(fileRef, 'sandboxPath') ?? getSandboxWorkspaceFilePath(record)
       await pushWorkspaceFileMount(
-        sandboxFiles,
+        mounts,
         record,
         mountPath,
-        mounted,
         workspaceId,
         filePrincipal,
-        resolvedSecretTraceRegistry,
         context.abortSignal
       )
     }
@@ -395,7 +412,7 @@ export async function resolveInputFiles(
           candidate.path !== folder.path && candidate.path.startsWith(`${folder.path}/`)
       )
       if (descendants.length === 0 && childFolders.length === 0) {
-        sandboxFiles.push({ path: `${mountRoot}/.keep`, content: '' })
+        mounts.files.push({ path: `${mountRoot}/.keep`, content: '' })
         continue
       }
       for (const childFolder of childFolders) {
@@ -408,7 +425,7 @@ export async function resolveInputFiles(
         })
         if (!hasFiles) {
           const relativeFolder = childFolder.path.slice(folder.path.length).replace(/^\/+/, '')
-          sandboxFiles.push({ path: `${mountRoot}/${relativeFolder}/.keep`, content: '' })
+          mounts.files.push({ path: `${mountRoot}/${relativeFolder}/.keep`, content: '' })
         }
       }
       for (const record of descendants) {
@@ -416,13 +433,11 @@ export async function resolveInputFiles(
           record.folderPath?.slice(folder.path.length).replace(/^\/+/, '') ?? ''
         const relativePath = [relativeFolder, record.name].filter(Boolean).join('/')
         await pushWorkspaceFileMount(
-          sandboxFiles,
+          mounts,
           record,
           `${mountRoot}/${relativePath}`,
-          mounted,
           workspaceId,
           filePrincipal,
-          resolvedSecretTraceRegistry,
           context.abortSignal
         )
       }
@@ -433,25 +448,22 @@ export async function resolveInputFiles(
     for (const tableRef of inputTables) {
       const tableId = refField(tableRef, 'tableId') ?? refField(tableRef, 'path')
       if (!tableId) continue
-      if (!resolvedSecretTraceRegistry) {
-        throw new Error(
-          `Input table "${tableId}" cannot be mounted because its secret provenance is unavailable.`
-        )
-      }
       try {
         const result = await executeCopilotTableUseCase(context, readTableSnapshot, {
           workspaceId,
           reference: tableId,
           sandboxPath: refField(tableRef, 'sandboxPath'),
-          budget: mounted,
+          budget: mounts.budget,
           signal: context.abortSignal,
         })
-        if (result.unsafeProvenance)
-          resolvedSecretTraceRegistry.markIncomplete('table-snapshot-unsafe-for-mount')
-        sandboxFiles.push(result.mount)
-        Object.assign(mounted, result.budget)
+        mounts.files.push(result.mount)
+        Object.assign(mounts.budget, result.budget)
       } catch (error) {
         context.abortSignal?.throwIfAborted()
+        if (error instanceof ContentRefusedError) {
+          mounts.excluded.push({ path: tableId, reason: UNVERIFIED_INPUT_REASON })
+          continue
+        }
         logger.error('Table input mount failed', { error, tableId })
         throw new Error(
           messageForCopilotTableError(error, 'Table input could not be read. Retry the mount.')
@@ -460,7 +472,7 @@ export async function resolveInputFiles(
     }
   }
 
-  return sandboxFiles
+  return { files: mounts.files, excluded: mounts.excluded }
 }
 
 async function importMountedProvenance(
@@ -513,6 +525,8 @@ export async function executeFunctionExecute(
     'sandboxSessionKey',
     // Server-derived from resolved inputs; a model-supplied mount would skip their provenance.
     '_sandboxFiles',
+    // Stored-file mounts by raw key bypass the classified `inputs`; Chat names files by path.
+    'files',
     PRIVATE_SECRET_PROVENANCE_FIELD,
   ])
   // One persistent session sandbox per chat: files and installed packages
@@ -554,6 +568,7 @@ export async function executeFunctionExecute(
       : undefined
   let mountedRegistry: ResolvedSecretTraceRegistry | undefined
   let crossingValue: unknown
+  let excludedInputs: ExcludedInput[] = []
 
   /**
    * Hoisted so the usage trail in `finally` attributes the run to the same identity the mount
@@ -625,16 +640,20 @@ export async function executeFunctionExecute(
       ]
 
       if (inputFiles?.length || inputTables?.length || inputDirectories.length) {
-        const resolved = await resolveInputFiles(
-          context,
-          inputFiles,
-          inputTables,
-          inputDirectories,
-          mountedRegistry
+        /** Mounted bytes reach the run's own registry, whose output then crosses into Chat's. */
+        const resolved = await observeContentDelivery(
+          createRegistryContentGate({
+            registry: mountedRegistry,
+            workspaceId: context.workspaceId,
+            organizationId: context.chatOrganizationId ?? context.organizationId,
+            actorUserId: context.userId,
+          }),
+          () => resolveInputFiles(context, inputFiles, inputTables, inputDirectories)
         )
-        if (resolved.length > 0) {
+        excludedInputs = resolved.excluded
+        if (resolved.files.length > 0) {
           const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
-          enrichedParams._sandboxFiles = [...existing, ...resolved]
+          enrichedParams._sandboxFiles = [...existing, ...resolved.files]
 
           const provenance = mountedRegistry.exportProvenance()
           const bundle: PrivateSecretProvenanceBundleV1 = {
@@ -707,7 +726,9 @@ export async function executeFunctionExecute(
       const cost = toRecord(toRecord(result.output)?.cost)
       if (typeof cost?.raw === 'number') await recordServiceCost('sandbox', cost.raw)
       crossingValue = result
-      return result
+      return excludedInputs.length > 0
+        ? { ...result, output: { ...toRecord(result.output), excludedInputs } }
+        : result
     } catch (error) {
       crossingValue = error
       throw error
diff --git a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
index eba6b76d179..3b86ca5d185 100644
--- a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
@@ -63,6 +63,7 @@ vi.mock('@/lib/mothership/vfs/resource-writer', () => ({
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import * as inProcessTransport from '@/lib/api/server/routes/in-process-transport'
+import { admitContent, type ContentProvenance } from '@/lib/core/application/content-delivery'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
@@ -91,8 +92,6 @@ import {
 } from '@/lib/mothership/tools/sandbox-resources'
 import { buildMothershipSandboxSession } from '@/lib/mothership/tools/sandbox-session'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
-import { reportTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { reportWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { buildFunctionExecuteBody, functionExecuteTool } from '@/tools/function/execute'
@@ -359,6 +358,37 @@ async function sandboxApi(path: string, handler: () => Promise<Response>, method
   })
 }
 
+/** What a sourced route does with an item it returns: admit it through the caller's gate. */
+async function deliver(
+  source: 'file' | 'table',
+  provenance: ContentProvenance,
+  value: unknown
+): Promise<boolean> {
+  const item = {
+    kind: source === 'file' ? ('workspace-file' as const) : ('table-row' as const),
+    id: 'fixture',
+    provenance,
+    view: source === 'file' ? ('complete' as const) : { derived: value },
+  }
+  const principal = createDelegatedPrincipal({
+    subjectUserId: scope.userId,
+    workspaceId: scope.workspaceId,
+  })
+  return (await admitContent(principal, [item])).admits(item)
+}
+
+const TOKEN_PROVENANCE = (): ContentProvenance => ({
+  status: 'exact',
+  entries: [
+    {
+      name: 'TOKEN',
+      encryptedValue: catalog[0].encryptedValue,
+      sourceUserId: scope.userId,
+      sourceWorkspaceId: scope.workspaceId,
+    },
+  ],
+})
+
 describe('generated workbench file provenance', () => {
   const identity = () => ({ providerId: 'e2b' as const, sandboxId: machine.sandboxId })
   const observer = () =>
@@ -554,37 +584,12 @@ describe('sandbox API provenance admission', () => {
   })
 
   it.each(['file', 'table'] as const)(
-    'imports explicit %s delivery evidence before later output',
+    'imports admitted %s delivery evidence before later output',
     async (source) => {
       const response = await sandboxApi(
         `/api/v2/${source === 'file' ? 'files/fixture' : 'tables/fixture/rows'}`,
         async () => {
-          if (source === 'file') {
-            await reportWorkspaceFileDelivery(
-              {
-                status: 'exact',
-                entries: [
-                  {
-                    name: 'TOKEN',
-                    encryptedValue: catalog[0].encryptedValue,
-                    sourceUserId: scope.userId,
-                    sourceWorkspaceId: scope.workspaceId,
-                  },
-                ],
-              },
-              'fixture'
-            )
-          } else {
-            await reportTableRowDelivery(
-              {
-                version: 1,
-                complete: true,
-                scope,
-                entries: [{ name: 'TOKEN', encryptedValue: catalog[0].encryptedValue }],
-              },
-              [{ value: canary }]
-            )
-          }
+          expect(await deliver(source, TOKEN_PROVENANCE(), canary)).toBe(true)
           return new Response(canary)
         }
       )
@@ -601,7 +606,7 @@ describe('sandbox API provenance admission', () => {
   it('accepts explicitly unrecorded file delivery and retains earlier secret history', async () => {
     await run('printf "%s" "$TOKEN" > saved.txt', ['TOKEN'])
     const response = await sandboxApi('/api/v2/files/fixture/download', async () => {
-      await reportWorkspaceFileDelivery({ status: 'unrecorded' }, 'fixture')
+      expect(await deliver('file', { status: 'unrecorded' }, 'ordinary user input')).toBe(true)
       return new Response('ordinary user input')
     })
     await machine.writeFile('/home/user/input.txt', await response.text())
@@ -626,16 +631,13 @@ describe('sandbox API provenance admission', () => {
           }
           return evalCommand(...args)
         })
-        await reportTableRowDelivery(
-          {
-            version: 1,
-            complete: true,
-            scope,
-            entries: [{ name: 'TOKEN', encryptedValue: catalog[0].encryptedValue }],
-          },
-          [{ value: canary }]
-        )
+        /** A committed write's gate failure is deferred past its effects, as the use case does. */
+        let failure: unknown
+        await deliver('table', TOKEN_PROVENANCE(), canary).catch((error: unknown) => {
+          failure = error
+        })
         await writeFile(mutationPath, JSON.stringify({ committed: true, completed: true }))
+        if (failure) throw failure
         return Response.json({ data: { value: canary } }, { status: 201 })
       },
       'POST'
@@ -652,22 +654,19 @@ describe('sandbox API provenance admission', () => {
   })
 
   it.each(['file', 'table'] as const)(
-    'preserves an explicit unknown %s delivery as unknown',
+    'refuses an unknown %s delivery and keeps the workbench usable',
     async (source) => {
-      await sandboxApi(
+      const response = await sandboxApi(
         `/api/v2/${source === 'file' ? 'files/fixture' : 'tables/fixture/rows'}`,
         async () => {
-          if (source === 'file') await reportWorkspaceFileDelivery({ status: 'unknown' }, 'fixture')
-          else
-            await reportTableRowDelivery({ version: 1, complete: false, entries: [] }, [
-              { value: 'unknown' },
-            ])
-          return new Response('unknown')
+          expect(await deliver(source, { status: 'unknown' }, 'unknown')).toBe(false)
+          return Response.json({ error: 'refused' }, { status: 403 })
         }
       )
+      expect(response.status).toBe(403)
       const result = await run('printf "ready"')
-      expect(result.projected.safe).toBe(false)
-      expect(JSON.stringify(result.projected.result)).not.toContain('ready')
+      expect(result.projected.safe).toBe(true)
+      expect(JSON.stringify(result.projected.result)).toContain('ready')
     }
   )
 })
diff --git a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts b/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts
deleted file mode 100644
index c2638090237..00000000000
--- a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { isCatalogRoute } from '@/lib/mothership/tools/sandbox-catalog-routes'
-
-function routePattern(path: string): string {
-  const matched = matchV2Route(path)
-  if (!matched) throw new Error(`No v2 route matches ${path}`)
-  return matched.pattern
-}
-
-describe('isCatalogRoute', () => {
-  it.each([
-    '/api/v2/blocks',
-    '/api/v2/blocks/slack',
-    '/api/v2/tools',
-    '/api/v2/tools/slack_message',
-    '/api/v2/connector-types',
-  ])('classifies GET %s, as the route table resolves it, as catalog', (path) => {
-    expect(isCatalogRoute('GET', routePattern(path))).toBe(true)
-  })
-
-  it('does not classify data-bearing or mutating routes as catalog', () => {
-    expect(isCatalogRoute('GET', routePattern('/api/v2/logs/run-1'))).toBe(false)
-    expect(isCatalogRoute('POST', routePattern('/api/v2/tools/slack_message/execute'))).toBe(false)
-    expect(isCatalogRoute('POST', routePattern('/api/v2/tools'))).toBe(false)
-  })
-})
diff --git a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts b/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts
deleted file mode 100644
index 5f9a71d216b..00000000000
--- a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import {
-  v2GetBlockContract,
-  v2GetToolContract,
-  v2ListBlocksContract,
-  v2ListConnectorTypesContract,
-  v2ListToolsContract,
-} from '@/lib/api/contracts/v2/catalog'
-
-/** Catalog contract paths in the generated route table's `{param}` pattern syntax. */
-const CATALOG_ROUTE_PATTERNS: ReadonlySet<string> = new Set(
-  [
-    v2ListBlocksContract,
-    v2GetBlockContract,
-    v2ListToolsContract,
-    v2GetToolContract,
-    v2ListConnectorTypesContract,
-  ].map((contract) => contract.path.replace(/\[([^\]]+)\]/g, '{$1}'))
-)
-
-/**
- * Whether a sandbox API request reads the producer-owned catalog (blocks, tools, connector
- * types): no execution output, file content, or row values, so no producer records secret
- * provenance for it and none is expected.
- */
-export function isCatalogRoute(method: string, routePattern: string): boolean {
-  return method === 'GET' && CATALOG_ROUTE_PATTERNS.has(routePattern)
-}
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
index abded34fef0..534f07aa8c4 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
@@ -6,12 +6,15 @@ import {
 import { urlsMockFns } from '@sim/testing/mocks/urls.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { isCopilotRequest } from '@/lib/api/server/routes/copilot-request'
+import {
+  type ContentSource,
+  noteContentDeliveryOperation,
+  requireAdmittedContent,
+} from '@/lib/core/application/content-delivery'
 import { assertWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import {
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { fileOperations } from '@/lib/workspace-files/application/operations'
 
 const { readScope, recordEffects, fetcher, routeMatcher, recordInput, mint } = vi.hoisted(() => ({
   readScope: vi.fn(),
@@ -259,7 +262,7 @@ vi.mock('@/lib/execution/remote-sandbox/session-file-provenance', () => ({
   recordExistingSessionFileInput: recordInput,
 }))
 
-it('does not poison public scratch after authenticated static catalog discovery', async () => {
+it('records nothing into the workbench for a route that returns no stored content', async () => {
   routeMatcher.mockReturnValue({
     params: { toolId: 'function_execute' },
     load: async () => ({ GET: fetcher }),
@@ -270,25 +273,34 @@ it('does not poison public scratch after authenticated static catalog discovery'
   expect(recordInput).not.toHaveBeenCalled()
 })
 
-it('cannot deliver a successful unclassified file response when recording its unknown provenance fails', async () => {
+const CHAT = createDelegatedPrincipal({ serviceId: 'copilot' })
+const fileSource = (provenance: ContentSource['provenance']): ContentSource => ({
+  kind: 'workspace-file',
+  id: 'file',
+  provenance,
+  view: 'complete',
+})
+
+it('replaces a successful response its sourced operation never classified with a 403', async () => {
   routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
-  fetcher.mockResolvedValue(new Response('unsafe'))
-  recordInput.mockRejectedValueOnce(new Error('storage unavailable'))
-  await expect(proxySandboxResourceRequest(request('/api/v2/files/file'), token)).rejects.toThrow(
-    'storage unavailable'
-  )
-  expect(fetcher).toHaveBeenCalledOnce()
+  fetcher.mockImplementation(async () => {
+    noteContentDeliveryOperation(fileOperations.readContent, CHAT)
+    return new Response('unclassified file text')
+  })
+  const response = await proxySandboxResourceRequest(request('/api/v2/files/file/text'), token)
+  expect(response.status).toBe(403)
+  expect(await response.text()).not.toContain('unclassified file text')
+  expect(recordInput).not.toHaveBeenCalled()
 })
 
 /**
- * The file read and download use cases refuse a Chat principal that no delivery observer records,
- * so the workbench's file reads depend on this proxy installing one around the route handler.
+ * The file read and download use cases refuse a Chat principal no gate observes, so the
+ * workbench's reads depend on this proxy installing its session gate around the route handler.
  */
-it('dispatches a workbench file read under a delivery observer the Copilot guard admits', async () => {
+it('admits a workbench file read under the session gate, recording it before the bytes return', async () => {
   routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
   fetcher.mockImplementation(async () => {
-    requireCopilotWorkspaceFileDeliveryObserver(createDelegatedPrincipal({ serviceId: 'copilot' }))
-    await reportWorkspaceFileDelivery({ status: 'exact', entries: [] }, 'file')
+    await requireAdmittedContent(CHAT, fileSource({ status: 'exact', entries: [] }))
     return new Response('file text')
   })
   recordInput.mockResolvedValueOnce(undefined)
@@ -300,6 +312,23 @@ it('dispatches a workbench file read under a delivery observer the Copilot guard
 
   expect(response.status).toBe(200)
   expect(await response.text()).toBe('file text')
+  expect(recordInput).toHaveBeenCalledWith(chatSandboxSessionKey(scope.chatId), {
+    status: 'exact',
+    entries: [],
+  })
+})
+
+it('withholds a result whose provenance the workbench history could not record', async () => {
+  routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
+  fetcher.mockImplementation(async () => {
+    await requireAdmittedContent(CHAT, fileSource({ status: 'exact', entries: [] }))
+    return new Response('file text')
+  })
+  recordInput.mockRejectedValueOnce(new Error('storage unavailable'))
+  const response = await proxySandboxResourceRequest(request('/api/v2/files/file/text'), token)
+  expect(response.status).toBe(502)
+  expect(await response.text()).not.toContain('file text')
+  expect(fetcher).toHaveBeenCalledOnce()
 })
 
 vi.mock('@/lib/mothership/chat/delegation', () => ({ mintDelegationToken: mint }))
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index b217859994a..84956c6116f 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -1,49 +1,27 @@
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { LRUCache } from 'lru-cache'
 import { NextRequest } from 'next/server'
-import { v2DownloadFileContract, v2ReadFileTextContract } from '@/lib/api/contracts/v2/files'
 import { markCopilotRequest } from '@/lib/api/server/routes/copilot-request'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
-import {
-  type DurableSecretProvenance,
-  durableSecretProvenanceFromEnvelope,
-  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
-  mergeDurableSecretProvenance,
-} from '@/lib/execution/durable-secret-provenance'
-import { reportDurableSecretProvenanceUnrecorded } from '@/lib/execution/durable-secret-provenance-telemetry'
-import { recordExistingSessionFileInput } from '@/lib/execution/remote-sandbox/session-file-provenance'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
+import { dispatchUnderContentGate } from '@/lib/mothership/content-delivery/dispatch'
+import {
+  createSessionContentGate,
+  WorkbenchProvenanceUnavailableError,
+} from '@/lib/mothership/content-delivery/session-gate'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
-import { isCatalogRoute } from '@/lib/mothership/tools/sandbox-catalog-routes'
 import {
   readSandboxResourceScope,
   recordSandboxResourceEffects,
 } from '@/lib/mothership/tools/sandbox-resources'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 
 const logger = createLogger('MothershipSandboxResourceTransport')
 
-/** How long one route's missing-provenance report suppresses repeats for that route. */
-const UNRECORDED_PROVENANCE_LOG_WINDOW_MS = 60 * 60 * 1000
-/** Memory backstop above the number of `method route` pairs the v2 route table can produce. */
-const UNRECORDED_PROVENANCE_LOG_MAX_ROUTES = 1_000
-
-/**
- * Data-bearing routes already reported as lacking a provenance producer. The gap is a
- * property of the route, not the request, so it is reported once per route per window.
- */
-const unrecordedProvenanceRoutesLogged = new LRUCache<string, true>({
-  max: UNRECORDED_PROVENANCE_LOG_MAX_ROUTES,
-  ttl: UNRECORDED_PROVENANCE_LOG_WINDOW_MS,
-})
-
 /** Private callback observes the real authenticated v2 request without changing its body or API contract. */
 export async function proxySandboxResourceRequest(
   request: Request,
@@ -117,7 +95,6 @@ async function proxyAuthorizedSandboxRequest(
   const forwarded = new Request(target, init)
   const effects: ResourceChange[] = []
   let response: Response | undefined
-  let rowProvenance: DurableSecretProvenance | undefined
   let dispatched = false
   /** Invoke the same handler with private request identity; the declared use case still authorizes current domain access. */
   const matched = matchV2Route(path)
@@ -139,61 +116,30 @@ async function proxyAuthorizedSandboxRequest(
     if (!(result instanceof Response)) throw new Error('Invalid sandbox API response')
     return result
   }
-  const recordInput = (provenance: boolean | DurableSecretProvenance) =>
-    recordExistingSessionFileInput(chatSandboxSessionKey(scope.chatId), provenance)
-  const fileRead =
-    method === 'GET' &&
-    [v2DownloadFileContract, v2ReadFileTextContract].some(
-      (contract) =>
-        contract.path.replace(/\[([^\]]+)\]/g, (_match, key) =>
-          encodeURIComponent(matched.params[key] ?? '')
-        ) === path
-    )
+  const gate = createSessionContentGate({
+    sessionKey: chatSandboxSessionKey(scope.chatId),
+    workspaceId: targetWorkspaceId,
+    actorUserId: scope.userId,
+  })
   const deliver = async () => {
     dispatched = true
-    let fileObserved = false
-    const result = await observeTableRowDelivery(
-      async (provenance, _values, extras) => {
-        rowProvenance = mergeDurableSecretProvenance(
-          rowProvenance ?? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
-          extras.unprovenancedErrorText
-            ? { status: 'unknown' }
-            : durableSecretProvenanceFromEnvelope(provenance)
-        )
-      },
-      () =>
-        observeWorkspaceFileDelivery(async (provenance) => {
-          if (provenance?.status === 'unrecorded') {
-            reportDurableSecretProvenanceUnrecorded({
-              surface: 'workspace-file',
-              workspaceId: targetWorkspaceId,
-              actorUserId: scope.userId,
-            })
-          }
-          await recordInput(provenance?.status === 'unrecorded' ? true : (provenance ?? false))
-          fileObserved = true
-        }, dispatch)
-    )
     try {
-      if (fileRead && !fileObserved && result.ok && result.body) await recordInput(false)
-      else if (!fileObserved && !rowProvenance && !isCatalogRoute(method, matched.pattern)) {
-        /** Missing producer evidence is unrecorded, not proof that the machine received a secret. */
-        const routeKey = `${method} ${matched.pattern}`
-        if (!unrecordedProvenanceRoutesLogged.has(routeKey)) {
-          unrecordedProvenanceRoutesLogged.set(routeKey, true)
-          logger.warn('Sandbox API response has no recorded secret provenance', {
-            method,
-            route: matched.pattern,
-            toolCallId: scope.toolCallId,
-          })
-        }
-      }
+      response = (await dispatchUnderContentGate(gate, dispatch)).response
     } catch (error) {
-      await result.body?.cancel().catch(() => {})
-      throw error
+      if (!(error instanceof WorkbenchProvenanceUnavailableError)) throw error
+      /** A mutation may already have committed; the result is withheld, never retried for it. */
+      logger.warn('Sandbox response provenance could not be recorded', {
+        toolCallId: scope.toolCallId,
+      })
+      response = Response.json(
+        {
+          error:
+            'The API request ran, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.',
+        },
+        { status: 502 }
+      )
     }
-    response = result
-    return result
+    return response
   }
   try {
     await createResourceEffectTransport(endpoint, deliver, effects)(forwarded)
@@ -240,24 +186,6 @@ async function proxyAuthorizedSandboxRequest(
       }
     })
   )
-  if (rowProvenance) {
-    // Row mutations have already committed; admission must not interrupt completion or effects.
-    try {
-      await recordInput(rowProvenance)
-    } catch {
-      await response.body?.cancel().catch(() => {})
-      logger.warn('Sandbox response provenance could not be recorded after API completion', {
-        toolCallId: scope.toolCallId,
-        status: response.status,
-      })
-      response = Response.json(
-        {
-          error: `API request completed with HTTP ${response.status}, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.`,
-        },
-        { status: 502 }
-      )
-    }
-  }
   return new Response(request.method === 'HEAD' ? null : response.body, {
     status: response.status,
     statusText: response.statusText,
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 030128fe095..e4dc935d2bb 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
+import { mustClassifyContent } from '@/lib/core/application/content-delivery'
 import { isDocSandboxEnabled } from '@/lib/core/config/env-flags'
 import { CodeLanguage } from '@/lib/execution/languages'
 import {
@@ -19,6 +20,7 @@ import {
 } from '@/lib/mothership/tools/server/files/doc-compiled-store'
 import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
 import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import { getContentType } from '@/app/api/files/utils'
@@ -344,6 +346,8 @@ interface LegacyCompileArgs {
   workspaceId: string
   ownerKey?: string
   signal?: AbortSignal
+  /** Who the compile reads for; absent for a server render that serves no principal's view. */
+  filePrincipal?: Principal
 }
 
 interface CompileArgs extends LegacyCompileArgs {
@@ -661,6 +665,21 @@ const COMPILABLE_FORMATS: Record<string, CompilableFormat> = {
   '.pdf': { magic: PDF_MAGIC, taskId: 'pdf-generate', contentType: PDF_MIME },
 }
 
+/**
+ * The files a Chat compile may read through the isolate's broker: every file its source names
+ * literally, each admitted by the caller's gate before the task runs. Other callers are
+ * unrestricted, as they have always been.
+ */
+async function admitBrokerFiles(args: LegacyCompileArgs): Promise<ReadonlySet<string> | undefined> {
+  const principal = args.filePrincipal
+  if (!principal || !mustClassifyContent(principal)) return undefined
+  const { images } = await resolveReferencedImages(args.source, args.workspaceId, principal)
+  for (const { record } of images) {
+    await requireAdmittedWorkspaceFile(principal, args.workspaceId, record, 'complete')
+  }
+  return new Set(images.map((image) => image.fileId))
+}
+
 async function compileDocInLegacySandbox(
   args: LegacyCompileArgs,
   fmt: E2BDocFormat
@@ -691,6 +710,7 @@ async function compileDocInLegacySandbox(
     }
   }
 
+  const readableWorkspaceFileIds = await admitBrokerFiles(args)
   const contributingFiles = new Map<string, WorkspaceFileSecretProvenanceIdentity>()
   const buffer = await runSandboxTask(
     format.taskId,
@@ -698,6 +718,7 @@ async function compileDocInLegacySandbox(
     {
       ownerKey: args.ownerKey,
       signal: args.signal,
+      ...(readableWorkspaceFileIds ? { readableWorkspaceFileIds } : {}),
       onWorkspaceFileAccess: (identity) => {
         contributingFiles.set(`${identity.context}:${identity.fileId}:${identity.key}`, identity)
       },
@@ -942,7 +963,10 @@ export async function resolveServableDocBytes(args: {
     if (!isDocSandboxEnabled) {
       const fmt = await getE2BDocFormat(fileName)
       if (!fmt) throw new Error(`Unsupported document format: ${fileName}`)
-      return compileDocInLegacySandbox({ source, fileName, workspaceId, ownerKey, signal }, fmt)
+      return compileDocInLegacySandbox(
+        { source, fileName, workspaceId, ownerKey, signal, filePrincipal },
+        fmt
+      )
     }
     const referencedFileIds = collectReferencedFileIds(source)
     if (referencedFileIds.size > 0) {
diff --git a/apps/sim/lib/mothership/tools/server/files/file-preview.ts b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
index 55ec225c7f7..2b34de4bd7a 100644
--- a/apps/sim/lib/mothership/tools/server/files/file-preview.ts
+++ b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import { observeContentOutsideModel } from '@/lib/core/application/content-delivery'
 import { executeCopilotFileUseCase } from '@/lib/mothership/application/execute-file-use-case'
 import type { ExecutionContext } from '@/lib/mothership/request/types'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
@@ -139,15 +140,18 @@ export async function loadWorkspaceFileTextForPreview(
   fileId: string
 ): Promise<WorkspaceFilePreviewBase | undefined> {
   try {
-    const { content: buffer } = await executeCopilotFileUseCase(
-      context,
-      readWorkspaceFileContent,
-      {
-        fileId,
-        assertedWorkspaceId: workspaceId,
-        maxBytes: MAX_PREVIEW_SOURCE_BYTES,
-      },
-      { fileId }
+    /** The preview streams to the user's own editor, never to the model. */
+    const { content: buffer } = await observeContentOutsideModel(() =>
+      executeCopilotFileUseCase(
+        context,
+        readWorkspaceFileContent,
+        {
+          fileId,
+          assertedWorkspaceId: workspaceId,
+          maxBytes: MAX_PREVIEW_SOURCE_BYTES,
+        },
+        { fileId }
+      )
     )
     return {
       text: buffer.toString('utf-8'),
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
index dc86c213bc7..2c7566a13d9 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { observeContentOutsideModel } from '@/lib/core/application/content-delivery'
 import { MAX_MEDIA_BYTES } from '@/lib/media/falai'
 import { type FfmpegOperation, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
 import { FFMPEG_LIMITS } from '@/lib/media/ffmpeg-limits'
@@ -137,18 +138,22 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
           fileId: fileRecord.id,
           key: fileRecord.key,
           context: fileRecord.storageContext ?? 'workspace',
+          ...(fileRecord.contentUpdatedAt ? { contentUpdatedAt: fileRecord.contentUpdatedAt } : {}),
         })
         inputRequiresOpaqueError ||=
           fileProvenance.status !== 'exact' || fileProvenance.entries.length > 0
-        const { content: buffer } = await executeCopilotFileUseCase(
-          context,
-          readWorkspaceFileContent,
-          {
-            fileId: fileRecord.id,
-            assertedWorkspaceId: workspaceId,
-            maxBytes: MAX_MEDIA_BYTES,
-          },
-          { fileId: fileRecord.id }
+        /** The output file carries every input's provenance, merged below; no input reaches a model. */
+        const { content: buffer } = await observeContentOutsideModel(() =>
+          executeCopilotFileUseCase(
+            context,
+            readWorkspaceFileContent,
+            {
+              fileId: fileRecord.id,
+              assertedWorkspaceId: workspaceId,
+              maxBytes: MAX_MEDIA_BYTES,
+            },
+            { fileId: fileRecord.id }
+          )
         )
         totalInputBytes += buffer.length
         if (totalInputBytes > MAX_MEDIA_BYTES) {
diff --git a/apps/sim/lib/organization-secrets/application/operations.ts b/apps/sim/lib/organization-secrets/application/operations.ts
index fed17df32ee..d8066585d43 100644
--- a/apps/sim/lib/organization-secrets/application/operations.ts
+++ b/apps/sim/lib/organization-secrets/application/operations.ts
@@ -37,6 +37,7 @@ export const organizationSecretOperations = {
   /** permission-group-exempt: runtime use is governed by the authorized Build conversation, independently of secret-management UI access. */
   listNames: defineOrganizationOperation({
     id: 'organization_secrets.names',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     delegationAudience: ORGANIZATION_SECRETS_AUDIENCE,
@@ -46,6 +47,7 @@ export const organizationSecretOperations = {
   /** permission-group-exempt: runtime use is governed by the authorized Build conversation, independently of secret-management UI access. */
   mount: defineOrganizationOperation({
     id: 'organization_secrets.mount',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     delegationAudience: ORGANIZATION_SECRETS_AUDIENCE,
diff --git a/apps/sim/lib/organizations/application/configuration-operations.ts b/apps/sim/lib/organizations/application/configuration-operations.ts
index 03671c19c4f..f3357bfe20b 100644
--- a/apps/sim/lib/organizations/application/configuration-operations.ts
+++ b/apps/sim/lib/organizations/application/configuration-operations.ts
@@ -11,6 +11,7 @@ export const organizationConfigurationOperations = {
   readWhitelabel: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.whitelabel.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -18,6 +19,7 @@ export const organizationConfigurationOperations = {
   updateWhitelabel: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.whitelabel.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
@@ -25,6 +27,7 @@ export const organizationConfigurationOperations = {
   readSessionPolicy: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.session_policy.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -32,6 +35,7 @@ export const organizationConfigurationOperations = {
   updateSessionPolicy: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.session_policy.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
@@ -39,6 +43,7 @@ export const organizationConfigurationOperations = {
   readDataRetention: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.data_retention.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -46,6 +51,7 @@ export const organizationConfigurationOperations = {
   updateDataRetention: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.data_retention.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
diff --git a/apps/sim/lib/organizations/application/member-roster.ts b/apps/sim/lib/organizations/application/member-roster.ts
index 98b2133ccad..a7b10a005d4 100644
--- a/apps/sim/lib/organizations/application/member-roster.ts
+++ b/apps/sim/lib/organizations/application/member-roster.ts
@@ -27,6 +27,7 @@ import {
 /** permission-group-exempt: members are checked below; admins retain access to manage the directory setting. */
 export const readOrganizationRosterOperation = defineOrganizationOperation({
   id: 'organization.members.roster',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'none',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/organizations/application/operations.ts b/apps/sim/lib/organizations/application/operations.ts
index 5f4fa9511d7..e79a5fc75d3 100644
--- a/apps/sim/lib/organizations/application/operations.ts
+++ b/apps/sim/lib/organizations/application/operations.ts
@@ -46,6 +46,7 @@ export const organizationOperations = {
    */
   updateMember: defineOrganizationOperation({
     id: 'organizations.members.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -58,6 +59,7 @@ export const organizationOperations = {
    */
   removeMember: defineOrganizationOperation({
     id: 'organizations.members.remove',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -97,6 +99,7 @@ export const organizationOperations = {
   }),
   createInvitation: defineOrganizationOperation({
     id: 'organizations.invitations.create',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'invitations.send',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -110,6 +113,7 @@ export const organizationSettingsOperations = {
   /** permission-group-exempt: organization members may read their organization's identity. */
   read: defineOrganizationOperation({
     id: 'organization.settings.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -119,6 +123,7 @@ export const organizationSettingsOperations = {
   /** permission-group-exempt: organization administrators manage its identity. */
   update: defineOrganizationOperation({
     id: 'organization.settings.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -139,6 +144,7 @@ export const organizationSecurityOperations = {
   listDomains: defineOrganizationOperation({
     oauthScope: 'api:read',
     id: 'organizations.domains.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     ...securityPolicy,
     capability: 'none',
@@ -147,6 +153,7 @@ export const organizationSecurityOperations = {
   addDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.add',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
@@ -155,6 +162,7 @@ export const organizationSecurityOperations = {
   verifyDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.verify',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
@@ -163,6 +171,7 @@ export const organizationSecurityOperations = {
   removeDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.remove',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
diff --git a/apps/sim/lib/permission-groups/application/operations.ts b/apps/sim/lib/permission-groups/application/operations.ts
index 869d8309616..5ec9f95fb55 100644
--- a/apps/sim/lib/permission-groups/application/operations.ts
+++ b/apps/sim/lib/permission-groups/application/operations.ts
@@ -7,6 +7,7 @@ function definePermissionGroupOperation<const Id extends string>(
 ) {
   return defineOrganizationOperation({
     id,
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -72,5 +73,6 @@ export const permissionGroupWorkspaceOperations = {
     delegatedServices: ['copilot'],
     oauthScope: 'api:read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
diff --git a/apps/sim/lib/sandboxes/application/operations.ts b/apps/sim/lib/sandboxes/application/operations.ts
index 35384ee8589..f92a4b9f1a3 100644
--- a/apps/sim/lib/sandboxes/application/operations.ts
+++ b/apps/sim/lib/sandboxes/application/operations.ts
@@ -33,6 +33,7 @@ export const sandboxOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -41,6 +42,7 @@ export const sandboxOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -49,6 +51,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -57,6 +60,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -65,6 +69,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/secrets/application/operations.ts b/apps/sim/lib/secrets/application/operations.ts
index 080eb2d2993..793558106c5 100644
--- a/apps/sim/lib/secrets/application/operations.ts
+++ b/apps/sim/lib/secrets/application/operations.ts
@@ -14,6 +14,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -23,6 +24,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -32,6 +34,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -45,6 +48,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -59,6 +63,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/selectors/application/operations.ts b/apps/sim/lib/selectors/application/operations.ts
index 8594705d022..588e3f31529 100644
--- a/apps/sim/lib/selectors/application/operations.ts
+++ b/apps/sim/lib/selectors/application/operations.ts
@@ -12,5 +12,6 @@ export const selectorOperations = {
     delegatedServices: ['copilot'],
     oauthScope: 'api:read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
diff --git a/apps/sim/lib/settings/application/context.ts b/apps/sim/lib/settings/application/context.ts
index 739dc35ed15..939c34d340c 100644
--- a/apps/sim/lib/settings/application/context.ts
+++ b/apps/sim/lib/settings/application/context.ts
@@ -7,6 +7,7 @@ const settingsContextOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/sim-search/live/application.ts b/apps/sim/lib/sim-search/live/application.ts
index 6c92a86a95c..d8d23667172 100644
--- a/apps/sim/lib/sim-search/live/application.ts
+++ b/apps/sim/lib/sim-search/live/application.ts
@@ -17,6 +17,7 @@ import {
   workspaceSearchFiltersSchema,
 } from '@/lib/api/contracts/mothership-assistant-tools'
 import { canonicalJson, fingerprint, instantScopePart } from '@/lib/api/cursor-binding'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { env } from '@/lib/core/config/env'
 import { isRetryableNetworkError } from '@/lib/core/errors/retryable-infrastructure'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -391,6 +392,8 @@ export const searchLiveKnowledge = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.search,
   resolveContext: ({ input }: { input: LiveSearchInput }) => resolveKnowledgeOwnerContext(input),
   async execute({ principal, input }): Promise<WorkspaceKnowledgeSearchData> {
+    /** Live provider results carry no stored provenance; they are projected through `safeContent`. */
+    await admitContent(principal, [])
     const userId = requirePrincipalSubjectUserId(principal)
     if (input.organizationId) await requireOrganizationSearchAvailable(input.organizationId)
     input.signal?.throwIfAborted()
@@ -851,6 +854,8 @@ export const readLiveDocument = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readDocument,
   resolveContext: ({ input }: { input: LiveReadInput }) => resolveKnowledgeOwnerContext(input),
   async execute({ principal, input }) {
+    /** Live provider documents carry no stored provenance; they are projected through `safeContent`. */
+    await admitContent(principal, [])
     const userId = requirePrincipalSubjectUserId(principal)
     if (input.organizationId) await requireOrganizationSearchAvailable(input.organizationId)
     if (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 8)
diff --git a/apps/sim/lib/skills/application/operations.ts b/apps/sim/lib/skills/application/operations.ts
index 766fe6f1fb9..c348a280a40 100644
--- a/apps/sim/lib/skills/application/operations.ts
+++ b/apps/sim/lib/skills/application/operations.ts
@@ -52,6 +52,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listAvailable: defineWorkspaceOperation({
@@ -60,6 +61,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -68,6 +70,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -76,6 +79,7 @@ export const skillOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -84,6 +88,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -102,6 +107,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -110,6 +116,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   listEditors: defineWorkspaceOperation({
@@ -118,6 +125,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HTTP_SKILL_EDITOR_READ_POLICY,
   }),
   grantEditor: defineWorkspaceOperation({
@@ -126,6 +134,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_HTTP_SKILL_EDITOR_POLICY,
   }),
   revokeEditor: defineWorkspaceOperation({
@@ -134,6 +143,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_HTTP_SKILL_EDITOR_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/table/application/operations.ts b/apps/sim/lib/table/application/operations.ts
index 103f0e4f31b..95eb7bae0c9 100644
--- a/apps/sim/lib/table/application/operations.ts
+++ b/apps/sim/lib/table/application/operations.ts
@@ -1,3 +1,4 @@
+import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
 import type { OperationDeclarableCapability } from '@/lib/core/application/operation'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 
@@ -27,9 +28,13 @@ const ALL_TABLE_TOOL_PRINCIPAL_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 
-function readOperation<const Id extends string>(id: Id) {
+function readOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:read',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -38,9 +43,13 @@ function readOperation<const Id extends string>(id: Id) {
   })
 }
 
-function writeOperation<const Id extends string>(id: Id) {
+function writeOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -60,10 +69,12 @@ function writeOperation<const Id extends string>(id: Id) {
  */
 function toolWriteOperation<const Id extends string>(
   id: Id,
-  capability: OperationDeclarableCapability
+  capability: OperationDeclarableCapability,
+  contentDelivery: ContentDeliveryDeclaration
 ) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -72,9 +83,13 @@ function toolWriteOperation<const Id extends string>(
   })
 }
 
-function toolReadOperation<const Id extends string>(id: Id) {
+function toolReadOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:read',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -90,6 +105,7 @@ function stagedReadOperation<const Id extends string>(
 ) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery: 'none',
     oauthScope,
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -101,6 +117,7 @@ function stagedReadOperation<const Id extends string>(
 function stagedWriteOperation<const Id extends string>(id: Id) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery: 'none',
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -110,30 +127,31 @@ function stagedWriteOperation<const Id extends string>(id: Id) {
 }
 
 export const tableOperations = {
-  list: toolReadOperation('tables.list'),
-  read: toolReadOperation('tables.read'),
+  list: toolReadOperation('tables.list', 'none'),
+  read: toolReadOperation('tables.read', 'none'),
   readSnapshot: defineWorkspaceOperation({
     id: 'tables.snapshot.read',
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'tables.use',
+    contentDelivery: 'sourced',
     ...COPILOT_PRINCIPAL_POLICY,
   }),
-  create: toolWriteOperation('tables.create', 'tables.create'),
-  update: writeOperation('tables.update'),
-  delete: writeOperation('tables.delete'),
-  restore: writeOperation('tables.restore'),
-  bulkMove: writeOperation('tables.bulk_move'),
-  bulkDelete: writeOperation('tables.bulk_delete'),
-  listFolders: readOperation('tables.folders.list'),
-  createFolder: writeOperation('tables.folders.create'),
-  updateFolder: writeOperation('tables.folders.update'),
-  deleteFolder: writeOperation('tables.folders.delete'),
-  restoreFolder: writeOperation('tables.folders.restore'),
-  addColumn: writeOperation('tables.columns.add'),
-  updateColumn: writeOperation('tables.columns.update'),
-  deleteColumn: writeOperation('tables.columns.delete'),
-  listRows: readOperation('tables.rows.list'),
+  create: toolWriteOperation('tables.create', 'tables.create', 'none'),
+  update: writeOperation('tables.update', 'none'),
+  delete: writeOperation('tables.delete', 'none'),
+  restore: writeOperation('tables.restore', 'none'),
+  bulkMove: writeOperation('tables.bulk_move', 'none'),
+  bulkDelete: writeOperation('tables.bulk_delete', 'none'),
+  listFolders: readOperation('tables.folders.list', 'none'),
+  createFolder: writeOperation('tables.folders.create', 'none'),
+  updateFolder: writeOperation('tables.folders.update', 'none'),
+  deleteFolder: writeOperation('tables.folders.delete', 'none'),
+  restoreFolder: writeOperation('tables.folders.restore', 'none'),
+  addColumn: writeOperation('tables.columns.add', 'none'),
+  updateColumn: writeOperation('tables.columns.update', 'none'),
+  deleteColumn: writeOperation('tables.columns.delete', 'none'),
+  listRows: readOperation('tables.rows.list', 'sourced'),
   analytics: defineWorkspaceOperation({
     id: 'tables.rows.analytics',
     minimumRole: 'read',
@@ -141,29 +159,29 @@ export const tableOperations = {
     capability: 'tables.use',
     principalKinds: ['session'],
   }),
-  queryRows: toolReadOperation('tables.rows.query'),
-  searchRows: readOperation('tables.rows.search'),
-  readRow: toolReadOperation('tables.rows.read'),
-  createRows: toolWriteOperation('tables.rows.create', 'tables.use'),
-  replaceRows: writeOperation('tables.rows.replace'),
-  updateRow: toolWriteOperation('tables.rows.update', 'tables.use'),
-  updateRows: toolWriteOperation('tables.rows.update_many', 'tables.use'),
-  deleteRow: toolWriteOperation('tables.rows.delete', 'tables.use'),
-  deleteRows: toolWriteOperation('tables.rows.delete_many', 'tables.use'),
-  upsertRow: toolWriteOperation('tables.rows.upsert', 'tables.use'),
-  listViews: readOperation('tables.views.list'),
-  readView: readOperation('tables.views.read'),
-  createView: writeOperation('tables.views.create'),
-  updateView: writeOperation('tables.views.update'),
-  deleteView: writeOperation('tables.views.delete'),
-  listGroups: readOperation('tables.groups.list'),
-  createGroup: toolWriteOperation('tables.groups.create', 'tables.use'),
-  updateGroup: toolWriteOperation('tables.groups.update', 'tables.use'),
-  deleteGroup: toolWriteOperation('tables.groups.delete', 'tables.use'),
-  startRun: writeOperation('tables.runs.start'),
+  queryRows: toolReadOperation('tables.rows.query', 'sourced'),
+  searchRows: readOperation('tables.rows.search', 'sourced'),
+  readRow: toolReadOperation('tables.rows.read', 'sourced'),
+  createRows: toolWriteOperation('tables.rows.create', 'tables.use', 'sourced'),
+  replaceRows: writeOperation('tables.rows.replace', 'none'),
+  updateRow: toolWriteOperation('tables.rows.update', 'tables.use', 'sourced'),
+  updateRows: toolWriteOperation('tables.rows.update_many', 'tables.use', 'none'),
+  deleteRow: toolWriteOperation('tables.rows.delete', 'tables.use', 'none'),
+  deleteRows: toolWriteOperation('tables.rows.delete_many', 'tables.use', 'none'),
+  upsertRow: toolWriteOperation('tables.rows.upsert', 'tables.use', 'sourced'),
+  listViews: readOperation('tables.views.list', 'none'),
+  readView: readOperation('tables.views.read', 'none'),
+  createView: writeOperation('tables.views.create', 'none'),
+  updateView: writeOperation('tables.views.update', 'none'),
+  deleteView: writeOperation('tables.views.delete', 'none'),
+  listGroups: readOperation('tables.groups.list', 'none'),
+  createGroup: toolWriteOperation('tables.groups.create', 'tables.use', 'none'),
+  updateGroup: toolWriteOperation('tables.groups.update', 'tables.use', 'none'),
+  deleteGroup: toolWriteOperation('tables.groups.delete', 'tables.use', 'none'),
+  startRun: writeOperation('tables.runs.start', 'none'),
   /** Reading the state of a run — including one you started — is a read. */
-  readRun: readOperation('tables.runs.read'),
-  cancelRuns: writeOperation('tables.runs.cancel'),
+  readRun: readOperation('tables.runs.read', 'none'),
+  cancelRuns: writeOperation('tables.runs.cancel', 'none'),
   createImport: stagedWriteOperation('tables.imports.create'),
   readImport: stagedReadOperation('tables.imports.read', 'tables.use', 'api:read'),
   createImportParts: stagedWriteOperation('tables.imports.create_parts'),
@@ -178,7 +196,18 @@ export const tableOperations = {
   createExport: stagedReadOperation('tables.exports.create', 'tables.export', 'api:write'),
   readExport: stagedReadOperation('tables.exports.read', 'tables.use', 'api:read'),
   cancelExport: stagedReadOperation('tables.exports.cancel', 'tables.use', 'api:write'),
-  downloadExport: stagedReadOperation('tables.exports.download', 'tables.export', 'api:read'),
+  /**
+   * A signed link to the whole table as plaintext, which no row provenance follows once fetched,
+   * so Chat is not delegated to it; it reads rows, each under its own provenance, instead.
+   */
+  downloadExport: defineWorkspaceOperation({
+    id: 'tables.exports.download',
+    oauthScope: 'api:read',
+    minimumRole: 'read',
+    workspaceApiKey: 'allow',
+    capability: 'tables.export',
+    principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'workspace_api_key'],
+  }),
 } as const
 
 export type TableOperation = (typeof tableOperations)[keyof typeof tableOperations]
diff --git a/apps/sim/lib/table/application/read-table-snapshot.ts b/apps/sim/lib/table/application/read-table-snapshot.ts
index f42d3e1442c..ed34ad76f26 100644
--- a/apps/sim/lib/table/application/read-table-snapshot.ts
+++ b/apps/sim/lib/table/application/read-table-snapshot.ts
@@ -1,4 +1,6 @@
+import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
 import {
   MAX_INLINE_MOUNT_FILE_BYTES,
@@ -38,7 +40,6 @@ export interface ReadTableSnapshotInput {
 export interface ReadTableSnapshotResult {
   mount: SandboxFile
   budget: SandboxMountBudget
-  unsafeProvenance: boolean
 }
 
 /** Resolves and reads one CSV snapshot under the caller's current workspace authority. */
@@ -48,7 +49,7 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
     input.signal?.throwIfAborted()
     return resolveTableWorkspaceContext(input.workspaceId)
   },
-  async execute({ input, context }): Promise<ReadTableSnapshotResult> {
+  async execute({ input, context, principal }): Promise<ReadTableSnapshotResult> {
     input.signal?.throwIfAborted()
     const reference = input.reference.replace(/^\/+/, '')
     const segments = reference.startsWith('tables/')
@@ -77,6 +78,16 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
         `Input table "${input.reference}" changed while preparing its snapshot. Retry.`
       )
     }
+    /**
+     * The snapshot is one cached CSV of every row, so the table enters the workbench whole or not
+     * at all: a row holding a recorded secret, or one without vouched provenance, keeps it out.
+     */
+    await requireAdmittedContent(principal, {
+      kind: 'table-row',
+      id: table.id,
+      provenance: safety === 'safe' ? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE : { status: 'unknown' },
+      view: 'complete',
+    })
     const budget = { ...input.budget }
     const path = input.sandboxPath ?? `/home/user/tables/${table.id}.csv`
     let mount: SandboxFile
@@ -110,6 +121,6 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
       budget.buffered += buffer.length
     }
     input.signal?.throwIfAborted()
-    return { mount, budget, unsafeProvenance: safety === 'unsafe-provenance' }
+    return { mount, budget }
   },
 })
diff --git a/apps/sim/lib/table/application/row-delivery-observer.ts b/apps/sim/lib/table/application/row-delivery-observer.ts
deleted file mode 100644
index 37168b52b70..00000000000
--- a/apps/sim/lib/table/application/row-delivery-observer.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-import type { RowData } from '@/lib/table/types'
-import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
-
-/** What a use case returns beside its rows that the rows' provenance does not cover. */
-export interface TableRowDeliveryExtras {
-  /**
-   * The result carries run-state or enrichment error text (`error`, `blockErrors`,
-   * cascade provider errors). That text is captured from executor output, which can
-   * contain resolved secret plaintext, and no provenance is persisted with it.
-   */
-  unprovenancedErrorText: boolean
-}
-
-type TableRowDeliveryObserver = (
-  provenance: ResolvedSecretTraceProvenanceV1,
-  values: RowData[],
-  extras: TableRowDeliveryExtras
-) => Promise<void>
-
-const observer = new AsyncLocalStorage<TableRowDeliveryObserver>()
-
-/** Internal transport evidence observes the persisted provenance of returned rows without changing public API admission or output. */
-export function observeTableRowDelivery<T>(observe: TableRowDeliveryObserver, execute: () => T): T {
-  return observer.run(observe, execute)
-}
-
-/** Whether the current call has a transport observing returned rows, so use cases read provenance for it. */
-export function hasTableRowDeliveryObserver(): boolean {
-  return observer.getStore() !== undefined
-}
-
-/** Runs before the canonical use case returns row data to its transport. */
-export async function reportTableRowDelivery(
-  provenance: ResolvedSecretTraceProvenanceV1,
-  values: RowData[],
-  extras: TableRowDeliveryExtras = { unprovenancedErrorText: false }
-): Promise<void> {
-  await observer.getStore()?.(provenance, values, extras)
-}
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index c79d6171a44..e7e71d9402a 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -22,13 +22,17 @@ import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/wo
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { TableDefinition } from '@/lib/table/types'
 
-const { mockIsScopeCompatible, mockLoadExecutionsForRow, mockLoadEnrichmentDetail } = vi.hoisted(
-  () => ({
-    mockIsScopeCompatible: vi.fn(),
-    mockLoadExecutionsForRow: vi.fn(),
-    mockLoadEnrichmentDetail: vi.fn(),
-  })
-)
+const {
+  mockIsScopeCompatible,
+  mockLoadExecutionsForRow,
+  mockLoadEnrichmentDetail,
+  mockRowProvenance,
+} = vi.hoisted(() => ({
+  mockIsScopeCompatible: vi.fn(),
+  mockLoadExecutionsForRow: vi.fn(),
+  mockLoadEnrichmentDetail: vi.fn(),
+  mockRowProvenance: vi.fn(),
+}))
 
 vi.mock('@sim/audit', () => auditMock)
 
@@ -45,7 +49,15 @@ vi.mock('@/lib/table/column-types', () => ({
   columnTypeOf: (column: { type: string }) => ({ id: column.type }),
 }))
 
-vi.mock('@/lib/table/rows/secret-provenance', () => tableRowsSecretProvenanceMock)
+/** The reader classifies each row on its own; `mockRowProvenance` answers per row id. */
+vi.mock('@/lib/table/rows/secret-provenance', () => ({
+  ...tableRowsSecretProvenanceMock,
+  TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
+    rowProvenance(rowId: string) {
+      return mockRowProvenance(rowId)
+    }
+  },
+}))
 
 vi.mock('@/lib/table/validation', () => ({
   coerceRowValues: vi.fn(),
@@ -70,8 +82,13 @@ vi.mock('@/lib/table/rows/executions', () => ({
 
 vi.mock('@/lib/table/events', () => tableEventsMock)
 
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { TABLE_LIMITS } from '@/lib/table'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
 import {
   batchUpdateTableRows,
   createTableRows,
@@ -833,11 +850,11 @@ describe('enrichment detail id validation', () => {
 })
 
 /**
- * An internal transport that observes delivery (the Copilot CLI) must see the
- * persisted provenance of every row a row-returning use case hands back, even
- * though the public surface it dispatched never asks for it on the wire.
+ * Chat's gate decides every row a row-returning use case hands back, each by its own persisted
+ * provenance, even though the public surface it dispatched never asks for it on the wire. Every
+ * other caller is served as before, without a provenance read.
  */
-describe('row delivery to an observing transport', () => {
+describe('row delivery to Chat', () => {
   const ENRICHED_TABLE: TableDefinition = {
     ...TABLE,
     schema: {
@@ -868,21 +885,29 @@ describe('row delivery to an observing transport', () => {
     mockUpsertRow.mockResolvedValue({ operation: 'update', row: ROW })
   })
 
+  const CHAT = createDelegatedPrincipal({
+    workspaceId: TABLE.workspaceId,
+    delegationId: 'copilot-tool:tool-1',
+    audience: 'sim:tables',
+    resourceScope: { tableId: TABLE.id },
+  })
+  type Caller = typeof PRINCIPAL | typeof CHAT
+
   const reads = {
-    list: () =>
-      listTableRows.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, limit: 25 } }),
-    query: () =>
-      queryTableRows.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, limit: 25 } }),
-    read: () =>
-      readTableRow.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, rowId: ROW.id } }),
-    enrichment: () =>
+    list: (principal: Caller) =>
+      listTableRows.execute({ principal, input: { tableId: TABLE.id, limit: 25 } }),
+    query: (principal: Caller) =>
+      queryTableRows.execute({ principal, input: { tableId: TABLE.id, limit: 25 } }),
+    read: (principal: Caller) =>
+      readTableRow.execute({ principal, input: { tableId: TABLE.id, rowId: ROW.id } }),
+    enrichment: (principal: Caller) =>
       readTableRowEnrichmentDetail.execute({
-        principal: PRINCIPAL,
+        principal,
         input: { tableId: TABLE.id, rowId: ROW.id, groupId: 'group-1' },
       }),
-    create: () =>
+    create: (principal: Caller) =>
       createTableRows.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           kind: 'single',
           tableId: TABLE.id,
@@ -891,9 +916,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    createBatch: () =>
+    createBatch: (principal: Caller) =>
       createTableRows.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           kind: 'batch',
           tableId: TABLE.id,
@@ -902,9 +927,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    update: () =>
+    update: (principal: Caller) =>
       updateTableRow.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           tableId: TABLE.id,
           rowId: ROW.id,
@@ -913,9 +938,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    upsert: () =>
+    upsert: (principal: Caller) =>
       upsertTableRow.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           tableId: TABLE.id,
           data: { name: 'secret-cell' },
@@ -924,31 +949,76 @@ describe('row delivery to an observing transport', () => {
         },
       }),
   }
+  const names = Object.keys(reads) as Array<keyof typeof reads>
+  const writes = new Set<keyof typeof reads>(['create', 'createBatch', 'update', 'upsert'])
+
+  function gate(verdict: boolean) {
+    return vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => verdict))
+  }
+
+  it.each(names)('%s admits each returned row for Chat by its own provenance', async (name) => {
+    const provenance = { status: 'exact', entries: [] }
+    mockRowProvenance.mockReturnValue(provenance)
+    const admit = gate(true)
+    await observeContentDelivery({ admit }, () => reads[name](CHAT))
+
+    expect(mockLoadSecretProvenance).toHaveBeenCalledWith(
+      { userId: CHAT.subjectUserId, workspaceId: TABLE.workspaceId },
+      undefined
+    )
+    expect(mockRowProvenance).toHaveBeenCalledWith(ROW.id)
+    expect(admit).toHaveBeenCalledTimes(1)
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'table-row', id: ROW.id, provenance, view: { derived: ROW.data } },
+    ])
+  })
+
+  it.each(names)('%s refuses Chat when no gate observes it', async (name) => {
+    await expect(reads[name](CHAT)).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+  })
 
-  it.each(Object.keys(reads) as Array<keyof typeof reads>)(
-    '%s reports the returned rows and their provenance',
+  it.each(['list', 'query'] as const)(
+    '%s leaves a refused row out of the page rather than withholding it',
     async (name) => {
-      const observe = vi.fn(async () => {})
-      const result = await observeTableRowDelivery(observe, reads[name])
+      mockRowProvenance.mockReturnValue({ status: 'unknown' })
+      const result = await observeContentDelivery({ admit: gate(false) }, () => reads[name](CHAT))
+      expect(result.rows).toEqual([])
+    }
+  )
 
-      expect(mockLoadSecretProvenance).toHaveBeenCalledWith(
-        {
-          userId: PRINCIPAL.userId,
-          workspaceId: TABLE.workspaceId,
-        },
-        undefined
-      )
-      expect(observe).toHaveBeenCalledTimes(1)
-      expect(observe).toHaveBeenCalledWith(
-        { version: 1, complete: true, entries: [] },
-        [ROW.data],
-        {
-          unprovenancedErrorText: false,
-        }
+  it.each(['read', 'enrichment'] as const)('%s refuses a refused row with a 403', async (name) => {
+    mockRowProvenance.mockReturnValue({ status: 'unknown' })
+    await expect(
+      observeContentDelivery({ admit: gate(false) }, () => reads[name](CHAT))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it.each([...writes])(
+    '%s commits and audits the write, then refuses its refused returned row',
+    async (name) => {
+      mockRowProvenance.mockReturnValue({ status: 'unknown' })
+      const refusal = await observeContentDelivery({ admit: gate(false) }, () =>
+        reads[name](CHAT)
+      ).then(
+        () => undefined,
+        (error: unknown) => error
       )
-      expect((result as { secretProvenance?: unknown }).secretProvenance).toBeUndefined()
+      expect(refusal).toBeInstanceOf(ContentRefusedError)
+      expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
+      expect(mockRecordAudit).toHaveBeenCalled()
+    }
+  )
+
+  it.each(names.filter((name) => !writes.has(name)))(
+    '%s reads no provenance for a session caller, which no gate classifies',
+    async (name) => {
+      const admit = gate(false)
+      await observeContentDelivery({ admit }, () => reads[name](PRINCIPAL))
+      expect(mockLoadSecretProvenance).not.toHaveBeenCalled()
+      expect(admit).not.toHaveBeenCalled()
     }
   )
+
   describe('run-state and enrichment error text', () => {
     const CLEAN_RUN = {
       status: 'completed',
@@ -964,57 +1034,51 @@ describe('row delivery to an observing transport', () => {
       blockErrors: { 'block-1': 'Authorization: Bearer sk-live-secret' },
     }
 
-    async function reportedErrorText(read: () => Promise<unknown>): Promise<boolean> {
-      const observe = vi.fn(async () => {})
-      await observeTableRowDelivery(observe, read)
-      expect(observe).toHaveBeenCalledTimes(1)
-      const extras = observe.mock.calls[0]?.[2] as { unprovenancedErrorText: boolean }
-      return extras.unprovenancedErrorText
-    }
-
     const withRunState = {
-      list: () =>
+      list: (principal: Caller) =>
         listTableRows.execute({
-          principal: PRINCIPAL,
+          principal,
           input: { tableId: TABLE.id, limit: 25, includeRunState: true },
         }),
-      query: () =>
+      query: (principal: Caller) =>
         queryTableRows.execute({
-          principal: PRINCIPAL,
+          principal,
           input: { tableId: TABLE.id, limit: 25, includeRunState: true },
         }),
     }
 
+    beforeEach(() => {
+      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
+    })
+
     it.each(Object.keys(withRunState) as Array<keyof typeof withRunState>)(
-      '%s signals returned run-state error text',
+      '%s withholds run-state error text from Chat and keeps it for other callers',
       async (name) => {
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [
-            { ...ROW, executions: { 'group-1': CLEAN_RUN } },
-            { ...ROW, id: 'row-2', executions: { 'group-1': RUN_WITH_ERROR } },
-          ],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(true)
-
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [{ ...ROW, executions: { 'group-1': RUN_WITH_BLOCK_ERROR } }],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(true)
+        for (const executions of [
+          { 'group-1': RUN_WITH_ERROR },
+          { 'group-1': RUN_WITH_BLOCK_ERROR },
+        ]) {
+          mockQueryRows.mockResolvedValue({ ...PAGE, rows: [{ ...ROW, executions }] })
+          const chat = await observeContentDelivery({ admit: gate(true) }, () =>
+            withRunState[name](CHAT)
+          )
+          expect(JSON.stringify(chat.rows)).not.toContain('sk-live-secret')
+          expect(chat.rows[0]?.executions?.['group-1']?.status).toBe('error')
+          const session = await withRunState[name](PRINCIPAL)
+          expect(JSON.stringify(session.rows)).toContain('sk-live-secret')
+        }
       }
     )
 
     it.each(Object.keys(withRunState) as Array<keyof typeof withRunState>)(
-      '%s does not signal run state without error text',
+      '%s leaves run state without error text unchanged for Chat',
       async (name) => {
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [
-            { ...ROW, executions: { 'group-1': { ...CLEAN_RUN, error: '', blockErrors: {} } } },
-          ],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(false)
+        const executions = { 'group-1': { ...CLEAN_RUN, error: '', blockErrors: {} } }
+        mockQueryRows.mockResolvedValue({ ...PAGE, rows: [{ ...ROW, executions }] })
+        const chat = await observeContentDelivery({ admit: gate(true) }, () =>
+          withRunState[name](CHAT)
+        )
+        expect(chat.rows[0]?.executions).toEqual(executions)
       }
     )
   })
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index 9f65e75baf4..f7ace7a4b2a 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -6,8 +6,17 @@ import { getRequestContext } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { isPlainRecord, toRecord } from '@sim/utils/object'
 import { capabilityGovernedPrincipalUserId } from '@/lib/core/application'
+import {
+  admitContent,
+  admitWrittenContent,
+  ContentRefusedError,
+  mustClassifyContent,
+} from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import { isPrivateSecretProvenanceScopeCompatible } from '@/lib/execution/durable-secret-provenance'
+import {
+  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
+  isPrivateSecretProvenanceScopeCompatible,
+} from '@/lib/execution/durable-secret-provenance'
 import type {
   BulkDeleteByIdsResult,
   BulkOperationResult,
@@ -51,10 +60,6 @@ import {
 import { defineAuthorizedTableUseCase } from '@/lib/table/application/authorized-table-use-case'
 import { resolveActiveTableContext } from '@/lib/table/application/context'
 import { tableOperations } from '@/lib/table/application/operations'
-import {
-  hasTableRowDeliveryObserver,
-  reportTableRowDelivery,
-} from '@/lib/table/application/row-delivery-observer'
 import {
   resolveRowWriteProvenance,
   type TableRowProvenanceEnvelope,
@@ -83,6 +88,7 @@ import {
 import { assertCursorQueryBinding, decodeCursor } from '@/lib/table/rows/cursor'
 import { loadEnrichmentDetail, loadExecutionsForRow } from '@/lib/table/rows/executions'
 import {
+  classifyStoredTableRowColumns,
   createExactEmptyTableRowSecretProvenance,
   createTableRowSecretProvenanceFromRegistry,
   createUnknownTableRowSecretProvenance,
@@ -147,66 +153,94 @@ interface TableResult {
 
 type TableRowsProvenance = ReturnType<TableRowProvenanceReader['exportProvenance']>
 
-/** Provenance is read when the caller asked for it or an internal transport observes delivery. */
+/** Provenance is read when the caller asked for it back or Chat must classify the rows. */
 function createAuthorizedRowsProvenanceReader(
+  principal: Principal,
   workspaceId: string,
   attributedUserId: string,
   include?: boolean
 ): TableRowProvenanceReader | undefined {
-  return include || hasTableRowDeliveryObserver()
+  return include || mustClassifyContent(principal)
     ? new TableRowProvenanceReader({ userId: attributedUserId, workspaceId })
     : undefined
 }
 
 /**
- * Reports the provenance of the rows a use case is about to return to an observing
- * transport, and hands it back only when the caller itself asked for it.
+ * Admits each returned row on its own, against the classification its reader captured, and returns
+ * the rows admitted. A row whose provenance is unknown is left out rather than withholding the
+ * page. `written` marks the rows a committed write returns (see `admitWrittenContent`).
  */
-async function deliverRowsProvenance(
+async function deliverRows<R extends { id: string; data: RowData }>(
+  principal: Principal,
   reader: TableRowProvenanceReader | undefined,
-  rows: readonly { data: RowData }[],
-  options: {
-    /** The caller itself asked for the provenance back. */
-    include?: boolean
-    /** The result also carries run-state or enrichment error text, which has no provenance. */
-    unprovenancedErrorText?: boolean
-  } = {}
-): Promise<TableRowsProvenance | undefined> {
-  if (!reader) return undefined
-  const provenance = reader.exportProvenance()
-  await reportTableRowDelivery(
-    provenance,
-    rows.map((row) => row.data),
-    { unprovenancedErrorText: options.unprovenancedErrorText ?? false }
-  )
-  return options.include ? provenance : undefined
+  rows: readonly R[],
+  options: { written?: boolean } = {}
+): Promise<R[]> {
+  if (!reader || !mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return [...rows]
+  }
+  const sources = rows.map((row) => ({
+    kind: 'table-row' as const,
+    id: row.id,
+    provenance: reader.rowProvenance(row.id),
+    view: { derived: row.data },
+  }))
+  const admission = await (options.written ? admitWrittenContent : admitContent)(principal, sources)
+  return rows.filter((_, index) => admission.admits(sources[index]))
 }
 
-function isNonEmptyText(value: unknown): boolean {
-  return typeof value === 'string' && value.length > 0
+/**
+ * Run-state and enrichment error text is captured from executor output, which can hold resolved
+ * secret plaintext, and nothing records its provenance, so Chat sees that an error occurred but
+ * not its text. Every other caller sees the text unchanged.
+ */
+const WITHHELD_ERROR_TEXT =
+  'Error details are not shown to Chat: they were captured from run output, which can hold secret values.'
+
+function withoutErrorText(execution: RowExecutionMetadata): RowExecutionMetadata {
+  return {
+    ...execution,
+    ...(execution.error ? { error: WITHHELD_ERROR_TEXT } : {}),
+    ...(execution.blockErrors
+      ? {
+          blockErrors: Object.fromEntries(
+            Object.keys(execution.blockErrors).map((blockId) => [blockId, WITHHELD_ERROR_TEXT])
+          ),
+        }
+      : {}),
+  }
 }
 
-/** Whether one group's run state carries error text: its run `error` or any `blockErrors` entry. */
-function executionHasErrorText(execution: RowExecutionMetadata): boolean {
-  return (
-    isNonEmptyText(execution.error) ||
-    Object.values(execution.blockErrors ?? {}).some(isNonEmptyText)
+function runStateForReader(principal: Principal, executions: RowExecutions): RowExecutions {
+  if (!mustClassifyContent(principal)) return executions
+  return Object.fromEntries(
+    Object.entries(executions).map(([groupId, execution]) => [groupId, withoutErrorText(execution)])
   )
 }
 
-/** Whether any group in a row's run state carries error text. */
-function runStateHasErrorText(executions: RowExecutions): boolean {
-  return Object.values(executions).some(executionHasErrorText)
+function rowsForReader(principal: Principal, rows: TableRow[]): TableRow[] {
+  if (!mustClassifyContent(principal)) return rows
+  return rows.map((row) =>
+    row.executions ? { ...row, executions: runStateForReader(principal, row.executions) } : row
+  )
 }
 
-/**
- * Whether an enrichment cascade carries provider error text. The blob is schemaless JSONB,
- * so it is read as defensively as the v2 presenter projects it.
- */
-function enrichmentDetailHasErrorText(detail: EnrichmentRunDetail | null): boolean {
+/** The enrichment blob is schemaless JSONB, so it is read as defensively as the v2 presenter does. */
+function enrichmentDetailForReader(
+  principal: Principal,
+  detail: EnrichmentRunDetail | null
+): EnrichmentRunDetail | null {
   const providers: unknown = detail?.providers
-  if (!Array.isArray(providers)) return false
-  return providers.some((provider) => isNonEmptyText(toRecord(provider).error))
+  if (!detail || !Array.isArray(providers) || !mustClassifyContent(principal)) return detail
+  return {
+    ...detail,
+    providers: providers.map((provider) =>
+      typeof toRecord(provider).error === 'string'
+        ? { ...toRecord(provider), error: WITHHELD_ERROR_TEXT }
+        : provider
+    ),
+  }
 }
 
 function requestId(input: TableScopedInput): string {
@@ -471,6 +505,7 @@ export const listTableRows = defineAuthorizedTableUseCase({
   async execute({ principal, input, context }): Promise<ListTableRowsResult> {
     requireIntegerInRange(input.limit, 1, TABLE_LIMITS.MAX_QUERY_LIMIT, 'Limit')
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId)
     )
@@ -490,14 +525,10 @@ export const listTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         readProvenance
       )
-      await deliverRowsProvenance(readProvenance, result.rows, {
-        unprovenancedErrorText:
-          input.includeRunState === true &&
-          result.rows.some((row) => runStateHasErrorText(row.executions)),
-      })
+      const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
-        rows: result.rows,
+        rows: rowsForReader(principal, rows),
         nextCursor: result.nextCursor,
       }
     } catch (error) {
@@ -537,6 +568,7 @@ export const queryTableRows = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: QueryTableRowsInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<QueryTableRowsResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -618,15 +650,14 @@ export const queryTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         readProvenance
       )
+      const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
         ...result,
-        secretProvenance: await deliverRowsProvenance(readProvenance, result.rows, {
-          include: input.includePersistedSecretProvenance,
-          unprovenancedErrorText:
-            input.includeRunState === true &&
-            result.rows.some((row) => runStateHasErrorText(row.executions)),
-        }),
+        rows: rowsForReader(principal, rows),
+        ...(input.includePersistedSecretProvenance && readProvenance
+          ? { secretProvenance: readProvenance.exportProvenance() }
+          : {}),
       }
     } catch (error) {
       rethrowQueryValidation(error)
@@ -634,6 +665,43 @@ export const queryTableRows = defineAuthorizedTableUseCase({
   },
 })
 
+/**
+ * A match says a cell's text contains the query, which answers a question about that text even
+ * though no value is returned. Chat keeps only matches in rows it could read and in cells holding
+ * no recorded secret; every other caller sees every match.
+ */
+async function admitRowMatches(
+  principal: Principal,
+  matches: FindRowMatch[]
+): Promise<FindRowMatch[]> {
+  if (matches.length === 0 || !mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return matches
+  }
+  const columns = await classifyStoredTableRowColumns(matches.map((match) => match.rowId))
+  const sources = [...columns].map(([rowId, classification]) => ({
+    kind: 'table-row' as const,
+    id: rowId,
+    provenance:
+      classification.status === 'exact'
+        ? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE
+        : ({ status: 'unknown' } as const),
+    view: 'opaque' as const,
+  }))
+  const admission = await admitContent(principal, sources)
+  const admitted = new Set(
+    sources.filter((source) => admission.admits(source)).map((source) => source.id)
+  )
+  return matches.filter((match) => {
+    const classification = columns.get(match.rowId)
+    return (
+      admitted.has(match.rowId) &&
+      classification?.status === 'exact' &&
+      !classification.secretColumns.has(match.column)
+    )
+  })
+}
+
 export interface SearchTableRowsInput extends TableScopedInput {
   q: string
   predicate?: TablePredicate
@@ -648,7 +716,7 @@ export interface SearchTableRowsResult extends TableResult {
 export const searchTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.searchRows,
   resolveContext: ({ input }: { input: SearchTableRowsInput }) => resolveActiveTableContext(input),
-  async execute({ input, context }): Promise<SearchTableRowsResult> {
+  async execute({ principal, input, context }): Promise<SearchTableRowsResult> {
     try {
       if (input.q.length === 0) {
         throw new TableRowsValidationError('q must be a non-empty search string')
@@ -667,7 +735,11 @@ export const searchTableRows = defineAuthorizedTableUseCase({
         { q: input.q, filter, sort },
         requestId(input)
       )
-      return { table: context.table, ...result }
+      return {
+        table: context.table,
+        ...result,
+        matches: await admitRowMatches(principal, result.matches),
+      }
     } catch (error) {
       rethrowQueryValidation(error)
     }
@@ -692,6 +764,7 @@ export const readTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: ReadTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<ReadTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -708,14 +781,16 @@ export const readTableRow = defineAuthorizedTableUseCase({
           budgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
         })
       : undefined
+    if ((await deliverRows(principal, readProvenance, [row])).length === 0) {
+      throw new ContentRefusedError('table-row')
+    }
     return {
       table: context.table,
       row,
-      ...(runState ? { runState } : {}),
-      secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-        include: input.includePersistedSecretProvenance,
-        unprovenancedErrorText: runState !== undefined && runStateHasErrorText(runState),
-      }),
+      ...(runState ? { runState: runStateForReader(principal, runState) } : {}),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
 })
@@ -753,6 +828,7 @@ export const readTableRowEnrichmentDetail = defineAuthorizedTableUseCase({
     resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<ReadTableRowEnrichmentResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId)
     )
@@ -774,17 +850,15 @@ export const readTableRowEnrichmentDetail = defineAuthorizedTableUseCase({
       loadEnrichmentDetail(db, context.tableId, input.rowId, input.groupId),
     ])
     const runState = executions[input.groupId] ?? null
-    await deliverRowsProvenance(readProvenance, [row], {
-      unprovenancedErrorText:
-        (runState !== null && executionHasErrorText(runState)) ||
-        enrichmentDetailHasErrorText(detail),
-    })
+    if ((await deliverRows(principal, readProvenance, [row])).length === 0) {
+      throw new ContentRefusedError('table-row')
+    }
     return {
       table: context.table,
       row,
       group,
-      runState,
-      detail,
+      runState: runState && mustClassifyContent(principal) ? withoutErrorText(runState) : runState,
+      detail: enrichmentDetailForReader(principal, detail),
     }
   },
 })
@@ -830,6 +904,7 @@ export const createTableRows = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: CreateTableRowsInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<CreateTableRowsResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -878,13 +953,14 @@ export const createTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         writeOptions
       )
+      await deliverRows(principal, readProvenance, [row], { written: true })
       return {
         kind: 'single',
         table: context.table,
         row,
-        secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-          include: input.includePersistedSecretProvenance,
-        }),
+        ...(input.includePersistedSecretProvenance && readProvenance
+          ? { secretProvenance: readProvenance.exportProvenance() }
+          : {}),
       }
     }
     if (input.rows.length < 1 || input.rows.length > TABLE_LIMITS.MAX_BATCH_INSERT_SIZE) {
@@ -933,13 +1009,14 @@ export const createTableRows = defineAuthorizedTableUseCase({
       requestId(input),
       batchWriteOptions
     )
+    await deliverRows(principal, readProvenance, created, { written: true })
     return {
       kind: 'batch',
       table: context.table,
       rows: created,
-      secretProvenance: await deliverRowsProvenance(readProvenance, created, {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => {
@@ -1244,6 +1321,7 @@ export const updateTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: UpdateTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<UpdateTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -1271,13 +1349,14 @@ export const updateTableRow = defineAuthorizedTableUseCase({
       { ...rowWriteOptions(input), readProvenance }
     )
     if (!row) throw new Error('Unconditional table row update was rejected')
+    await deliverRows(principal, readProvenance, [row], { written: true })
     return {
       table: context.table,
       row,
       changed: Object.keys(data).length > 0,
-      secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => {
@@ -1594,6 +1673,7 @@ export const upsertTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: UpsertTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<UpsertTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -1626,13 +1706,14 @@ export const upsertTableRow = defineAuthorizedTableUseCase({
       requestId(input),
       { ...rowWriteOptions(input), readProvenance }
     )
+    await deliverRows(principal, readProvenance, [result.row], { written: true })
     return {
       table: context.table,
       row: result.row,
       operation: result.operation,
-      secretProvenance: await deliverRowsProvenance(readProvenance, [result.row], {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => ({
diff --git a/apps/sim/lib/table/import-data.ts b/apps/sim/lib/table/import-data.ts
index e8b52936d39..ab25e7e0ac2 100644
--- a/apps/sim/lib/table/import-data.ts
+++ b/apps/sim/lib/table/import-data.ts
@@ -12,6 +12,7 @@ import { and, eq } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { assertRowCapacity, notifyTableRowUsage } from '@/lib/table/billing'
 import { CSV_MAX_BATCH_SIZE } from '@/lib/table/import'
+import type { ImportedRowProvenance } from '@/lib/table/import-provenance'
 import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { nKeysBetween } from '@/lib/table/order-key'
 import type { DbTransaction } from '@/lib/table/planner'
@@ -50,6 +51,8 @@ export interface BulkImportBatch {
   startPosition: number
   /** Previous batch's last `order_key` (the append anchor); null for the first batch / empty table. */
   afterOrderKey?: string | null
+  /** Provenance each row inherits from its source; absent, rows are exact-empty. */
+  rowProvenance?: ImportedRowProvenance
 }
 
 /**
@@ -147,7 +150,7 @@ export async function bulkInsertImportBatch(
     return mutateTableRowsWithSecretProvenance(trx, {
       rows: rowsToInsert.map((row) => ({
         rowId: row.id,
-        provenance: createExactEmptyTableRowSecretProvenance(row.data),
+        provenance: (data.rowProvenance ?? createExactEmptyTableRowSecretProvenance)(row.data),
       })),
       rowState: 'new',
       mode: 'replace',
diff --git a/apps/sim/lib/table/import-provenance.ts b/apps/sim/lib/table/import-provenance.ts
new file mode 100644
index 00000000000..0c34f4a37e7
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.ts
@@ -0,0 +1,43 @@
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  createExactEmptyTableRowSecretProvenance,
+  createTableRowSecretProvenanceFromRegistry,
+  createUnknownTableRowSecretProvenance,
+} from '@/lib/table/rows/secret-provenance'
+import type { RowData, TableRowSecretProvenanceWrite } from '@/lib/table/types'
+import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/** Stamps each imported row with the provenance its cells inherit from the source file. */
+export type ImportedRowProvenance = (row: RowData) => TableRowSecretProvenanceWrite
+
+/**
+ * The provenance every row of an import inherits from the stored file it reads, resolved by the
+ * storage key the import streams, so a job queued before this existed is covered too. A source
+ * whose provenance is unknown makes every row unknown: the import still succeeds for every caller,
+ * and only reads that classify content (Chat's) refuse those rows. A source holding secrets gives
+ * each cell exactly the secrets its own value contains. A key no file names (a direct upload), or
+ * a file with no recorded secrets, keeps the exact-empty rows every import has always written.
+ */
+export async function resolveImportedRowProvenance(source: {
+  workspaceId: string
+  userId?: string
+  fileKey: string
+}): Promise<ImportedRowProvenance> {
+  const provenance = (
+    await getStoredFileSecretProvenanceByKey(source.workspaceId, [source.fileKey])
+  ).get(source.fileKey)
+  if (!provenance) return createExactEmptyTableRowSecretProvenance
+  if (provenance.status === 'unknown') return createUnknownTableRowSecretProvenance
+  if (provenance.status === 'unrecorded' || provenance.entries.length === 0) {
+    return createExactEmptyTableRowSecretProvenance
+  }
+  const registry = new ResolvedSecretTraceRegistry(
+    [],
+    source.userId ? { userId: source.userId, workspaceId: source.workspaceId } : undefined
+  )
+  if (!(await importDurableSecretProvenance(registry, provenance))) {
+    return createUnknownTableRowSecretProvenance
+  }
+  return (row) => createTableRowSecretProvenanceFromRegistry(row, registry)
+}
diff --git a/apps/sim/lib/table/import-runner.ts b/apps/sim/lib/table/import-runner.ts
index 14a8c336e5f..8f09083452a 100644
--- a/apps/sim/lib/table/import-runner.ts
+++ b/apps/sim/lib/table/import-runner.ts
@@ -29,6 +29,7 @@ import {
   deleteAllTableRows,
   setTableSchemaForImport,
 } from '@/lib/table/import-data'
+import { resolveImportedRowProvenance } from '@/lib/table/import-provenance'
 import { createCsvParser } from '@/lib/table/import-stream'
 import {
   markJobFailedInWorkspace,
@@ -162,6 +163,9 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
     // the local dev provider, in which case the bar stays indeterminate (rows still show).
     const totalBytes = (await headObject(fileKey, storageContext))?.size ?? 0
 
+    /** Classified before a byte is read, by the key streamed below; see the resolver. */
+    const rowProvenance = await resolveImportedRowProvenance({ workspaceId, userId, fileKey })
+
     // Stream the file rather than buffering it — a ~1M-row import must never be held in memory.
     source = await downloadFileStream({ key: fileKey, context: storageContext })
 
@@ -319,6 +323,7 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
           rows: coerced,
           startPosition: basePosition + inserted,
           afterOrderKey: lastOrderKey,
+          rowProvenance,
         },
         { ...table, schema },
         requestId,
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index 7e38aab43e9..cb6dfdb2503 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -8,6 +8,7 @@ import { createLogger } from '@sim/logger'
 import { isRecordLike } from '@sim/utils/object'
 import { compareStrings } from '@sim/utils/string'
 import { and, asc, eq, gt, inArray, type SQL, sql } from 'drizzle-orm'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
 import {
   PROVENANCE_MAX_ENTRIES,
@@ -865,38 +866,25 @@ function createStoredEntryAggregator(scope: ResolvedSecretTraceScopeV1) {
   }
 }
 
+type TableRowClassification =
+  | { status: 'exact'; entries: StoredTableRowSecretProvenanceEntry[] }
+  | { status: 'unknown'; cause: string }
+
 /**
- * Builds one bounded provenance envelope for rows crossing an authenticated
- * internal table boundary. Untracked legacy rows contribute an exact-empty
- * report; tracked missing, stale, or malformed sidecars make the report
- * incomplete without inspecting configured secret plaintext.
+ * Classifies each crossing row on its own, against its sidecar at the revision that was read:
+ * untracked legacy rows are exact-empty; a missing, stale, malformed, or non-exact sidecar, or a
+ * row read twice at different revisions, is unknown. Entries are narrowed to the columns crossing.
  */
-export async function loadTableRowSecretProvenance(
+async function classifyTableRowCrossings(
   rows: TableRowCrossing[],
-  scope: ResolvedSecretTraceScopeV1,
-  executor: DbExecutor = db
-): Promise<ResolvedSecretTraceProvenanceV1> {
-  if (rows.length === 0) {
-    return { version: 1, complete: true, entries: [], scope }
-  }
-
-  const incomplete = (cause: string): ResolvedSecretTraceProvenanceV1 => {
-    logger.error('Table row read could not establish secret provenance', {
-      surface: 'table-row',
-      cause,
-      rowCount: rows.length,
-      workspaceId: scope.workspaceId,
-      actorUserId: scope.userId,
-    })
-    return { version: 1, complete: false, entries: [], scope }
-  }
-
-  const crossingById = new Map<string, TableRowCrossing & { selectedColumnIds?: Set<string> }>()
+  executor: DbExecutor
+): Promise<Map<string, TableRowClassification>> {
+  const crossingById = new Map<
+    string,
+    TableRowCrossing & { selectedColumnIds?: Set<string>; conflicting?: boolean }
+  >()
   for (const row of rows) {
     const existing = crossingById.get(row.id)
-    if (existing && !sameTimestamp(existing.updatedAt, row.updatedAt)) {
-      return incomplete('duplicate-row-revision')
-    }
     const selectedColumnIds = row.selectedValues
       ? new Set(Object.keys(row.selectedValues))
       : undefined
@@ -904,40 +892,156 @@ export async function loadTableRowSecretProvenance(
       crossingById.set(row.id, { ...row, selectedColumnIds })
       continue
     }
+    if (!sameTimestamp(existing.updatedAt, row.updatedAt)) existing.conflicting = true
     if (!existing.selectedColumnIds || !selectedColumnIds) {
       existing.selectedColumnIds = undefined
       continue
     }
     for (const columnId of selectedColumnIds) existing.selectedColumnIds.add(columnId)
   }
-  const rowIds = [...crossingById.keys()]
-  const currentRows = await selectRowsWithSidecars(executor, rowIds)
+  const currentRows = await selectRowsWithSidecars(
+    executor,
+    [...crossingById.values()].filter((row) => !row.conflicting).map((row) => row.id)
+  )
   const currentById = new Map(currentRows.map((row) => [row.id, row]))
-  const aggregator = createStoredEntryAggregator(scope)
-
-  for (const rowId of rowIds) {
+  const result = new Map<string, TableRowClassification>()
+  for (const [rowId, crossing] of crossingById) {
     const current = currentById.get(rowId)
-    const crossing = crossingById.get(rowId)
-    if (!current || !crossing) return incomplete('row-missing')
+    if (crossing.conflicting) {
+      result.set(rowId, { status: 'unknown', cause: 'duplicate-row-revision' })
+      continue
+    }
+    if (!current) {
+      result.set(rowId, { status: 'unknown', cause: 'row-missing' })
+      continue
+    }
     if (!sameTimestamp(current.updatedAt, crossing.updatedAt)) {
-      return incomplete('row-revision-mismatch')
+      result.set(rowId, { status: 'unknown', cause: 'row-revision-mismatch' })
+      continue
+    }
+    if (current.secretProvenanceVersion === null) {
+      result.set(rowId, { status: 'exact', entries: [] })
+      continue
     }
-    if (current.secretProvenanceVersion === null) continue
     if (
       current.secretProvenanceVersion !== TABLE_ROW_SECRET_PROVENANCE_VERSION ||
       current.sidecarStatus !== 'exact' ||
       !current.sidecarIsCurrent
     ) {
-      return incomplete('row-sidecar-not-exact')
+      result.set(rowId, { status: 'unknown', cause: 'row-sidecar-not-exact' })
+      continue
     }
     const parsed = normalizeStoredEntries(current.sidecarEntries)
-    if (!parsed) return incomplete('row-sidecar-malformed')
-    for (const entry of parsed) {
-      if (crossing.selectedColumnIds && !crossing.selectedColumnIds.has(entry.columnId)) continue
-      if (!aggregator.add(entry)) return incomplete('row-provenance-budget-exceeded')
+    if (!parsed) {
+      result.set(rowId, { status: 'unknown', cause: 'row-sidecar-malformed' })
+      continue
+    }
+    result.set(rowId, {
+      status: 'exact',
+      entries: parsed.filter(
+        (entry) => !crossing.selectedColumnIds || crossing.selectedColumnIds.has(entry.columnId)
+      ),
+    })
+  }
+  return result
+}
+
+/**
+ * For each row as it is stored now, the columns whose cells hold a recorded secret, or `unknown`
+ * when the row cannot be vouched for. A match oracle (row search) consults it: a cell that matched
+ * reveals something about its text whatever the result shows.
+ */
+export async function classifyStoredTableRowColumns(
+  rowIds: readonly string[],
+  executor: DbExecutor = db
+): Promise<Map<string, { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }>> {
+  const ids = [...new Set(rowIds)]
+  const currentRows = await selectRowsWithSidecars(executor, ids)
+  const result = new Map<
+    string,
+    { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }
+  >()
+  for (const current of currentRows) {
+    if (current.secretProvenanceVersion === null) {
+      result.set(current.id, { status: 'exact', secretColumns: new Set() })
+      continue
     }
+    const parsed =
+      current.secretProvenanceVersion === TABLE_ROW_SECRET_PROVENANCE_VERSION &&
+      current.sidecarStatus === 'exact' &&
+      current.sidecarIsCurrent
+        ? normalizeStoredEntries(current.sidecarEntries)
+        : undefined
+    result.set(
+      current.id,
+      parsed
+        ? { status: 'exact', secretColumns: new Set(parsed.map((entry) => entry.columnId)) }
+        : { status: 'unknown' }
+    )
   }
+  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
+  return result
+}
 
+/**
+ * Builds one bounded provenance envelope for rows crossing an authenticated
+ * internal table boundary. Untracked legacy rows contribute an exact-empty
+ * report; tracked missing, stale, or malformed sidecars make the report
+ * incomplete without inspecting configured secret plaintext.
+ */
+export async function loadTableRowSecretProvenance(
+  rows: TableRowCrossing[],
+  scope: ResolvedSecretTraceScopeV1,
+  executor: DbExecutor = db
+): Promise<ResolvedSecretTraceProvenanceV1> {
+  if (rows.length === 0) {
+    return { version: 1, complete: true, entries: [], scope }
+  }
+  /** One envelope covers every row, so a row read at two revisions settles it unread. */
+  const revisions = new Map<string, TableRowCrossing['updatedAt']>()
+  const conflicting = rows.some((row) => {
+    const seen = revisions.get(row.id)
+    revisions.set(row.id, row.updatedAt)
+    return seen !== undefined && !sameTimestamp(seen, row.updatedAt)
+  })
+  if (conflicting) {
+    return envelopeFromClassifications(
+      new Map<string, TableRowClassification>([
+        ['', { status: 'unknown', cause: 'duplicate-row-revision' }],
+      ]),
+      rows.length,
+      scope
+    )
+  }
+  return envelopeFromClassifications(
+    await classifyTableRowCrossings(rows, executor),
+    rows.length,
+    scope
+  )
+}
+
+function envelopeFromClassifications(
+  classifications: ReadonlyMap<string, TableRowClassification>,
+  rowCount: number,
+  scope: ResolvedSecretTraceScopeV1
+): ResolvedSecretTraceProvenanceV1 {
+  const incomplete = (cause: string): ResolvedSecretTraceProvenanceV1 => {
+    logger.error('Table row read could not establish secret provenance', {
+      surface: 'table-row',
+      cause,
+      rowCount,
+      workspaceId: scope.workspaceId,
+      actorUserId: scope.userId,
+    })
+    return { version: 1, complete: false, entries: [], scope }
+  }
+  const aggregator = createStoredEntryAggregator(scope)
+  for (const classification of classifications.values()) {
+    if (classification.status === 'unknown') return incomplete(classification.cause)
+    for (const entry of classification.entries) {
+      if (!aggregator.add(entry)) return incomplete('row-provenance-budget-exceeded')
+    }
+  }
   const entries = aggregator.build()
   if (!entries) return incomplete('row-provenance-budget-exceeded')
   const provenance: ResolvedSecretTraceProvenanceV1 = {
@@ -960,6 +1064,8 @@ export async function loadTableRowSecretProvenance(
  */
 export class TableRowProvenanceReader {
   private readonly accumulator: ResolvedSecretTraceProvenanceAccumulator
+  /** Every row captured, classified on its own. A row never captured has no classification. */
+  private readonly rows = new Map<string, DurableSecretProvenance>()
 
   constructor(
     private readonly scope: ResolvedSecretTraceScopeV1,
@@ -972,26 +1078,44 @@ export class TableRowProvenanceReader {
     executor: DbExecutor,
     rows: { id: string; updatedAt: Date | string; data: unknown }[]
   ): Promise<void> {
-    this.accumulator.record(
-      await loadTableRowSecretProvenance(
-        rows.map((row) => {
-          const data = row.data as RowData
-          let selectedValues = data
-          if (this.selectedColumnIds) {
-            selectedValues = {}
-            for (const columnId of this.selectedColumnIds) {
-              if (Object.hasOwn(data, columnId)) selectedValues[columnId] = data[columnId]
-            }
+    if (rows.length === 0) {
+      this.accumulator.record({ version: 1, complete: true, entries: [], scope: this.scope })
+      return
+    }
+    const classifications = await classifyTableRowCrossings(
+      rows.map((row) => {
+        const data = row.data as RowData
+        let selectedValues = data
+        if (this.selectedColumnIds) {
+          selectedValues = {}
+          for (const columnId of this.selectedColumnIds) {
+            if (Object.hasOwn(data, columnId)) selectedValues[columnId] = data[columnId]
           }
-          return { id: row.id, updatedAt: row.updatedAt, selectedValues }
-        }),
-        this.scope,
-        executor
-      )
+        }
+        return { id: row.id, updatedAt: row.updatedAt, selectedValues }
+      }),
+      executor
     )
+    for (const [rowId, classification] of classifications) {
+      this.rows.set(
+        rowId,
+        classification.status === 'unknown'
+          ? { status: 'unknown' }
+          : {
+              status: 'exact',
+              entries: classification.entries.map(({ columnId: _column, ...entry }) => entry),
+            }
+      )
+    }
+    this.accumulator.record(envelopeFromClassifications(classifications, rows.length, this.scope))
   }
 
   exportProvenance(): ResolvedSecretTraceProvenanceV1 {
     return this.accumulator.exportProvenance()
   }
+
+  /** One captured row's classification; a row this reader never captured is unknown. */
+  rowProvenance(rowId: string): DurableSecretProvenance {
+    return this.rows.get(rowId) ?? { status: 'unknown' }
+  }
 }
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.test.ts b/apps/sim/lib/tool-execution/application/execute-tool.test.ts
index fc13882fb25..6b6fb45dc49 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.test.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.test.ts
@@ -1,5 +1,6 @@
 import type { PersonalApiKeyPrincipal, SessionPrincipal } from '@sim/auth/principal'
 import {
+  createDelegatedPrincipal,
   createPersonalApiKeyPrincipal,
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
@@ -311,6 +312,33 @@ describe('executeToolForCaller', () => {
     }
   )
 
+  it('refuses Chat a tool whose result carries secret provenance, before dispatch', async () => {
+    toolsMockFns.mockToolResultCarriesSecretProvenance.mockImplementation(
+      (toolId: string) => toolId === 'file_read'
+    )
+    const chat = createDelegatedPrincipal({
+      workspaceId: WORKSPACE_ID,
+      audience: 'sim:tool-execution',
+    })
+    await expect(
+      executeToolForCaller.execute({
+        principal: chat,
+        input: { workspaceId: WORKSPACE_ID, toolId: 'file_read', input: { fileId: 'file-1' } },
+      })
+    ).rejects.toMatchObject({ code: 'forbidden' })
+    expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
+
+    /** The same tool still runs for a person. */
+    mocks.executeRegistryTool.mockResolvedValue({ success: true, output: { files: [] } })
+    await expect(
+      executeToolForCaller.execute({
+        principal,
+        input: { workspaceId: WORKSPACE_ID, toolId: 'file_read', input: { fileId: 'file-1' } },
+      })
+    ).resolves.toMatchObject({ status: 'succeeded' })
+    toolsMockFns.mockToolResultCarriesSecretProvenance.mockReturnValue(false)
+  })
+
   it.each(['callerPrincipal', 'principal', 'operationContext', '_context'])(
     'rejects caller input attempting to supply %s authority',
     async (key) => {
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.ts b/apps/sim/lib/tool-execution/application/execute-tool.ts
index 9612a06e772..748e6873b7c 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.ts
@@ -14,6 +14,7 @@ import {
   resolveVisibleToolOwners,
 } from '@/lib/catalog/application/tool-scope'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
+import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -22,7 +23,7 @@ import { principalUserId } from '@/lib/integrations/principal-scope.server'
 import { toolExecutionOperations } from '@/lib/tool-execution/application/operations'
 import { isEnvVarReference } from '@/executor/constants'
 import { resolveEnvVarReferences } from '@/executor/utils/reference-validation'
-import { executeTool as executeRegistryTool } from '@/tools'
+import { executeTool as executeRegistryTool, toolResultCarriesSecretProvenance } from '@/tools'
 import type { ExecutableToolConfig } from '@/tools/types'
 import { getTool } from '@/tools/utils'
 
@@ -314,6 +315,16 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
 
     const tool = getTool(toolId)
     if (!tool) throw new OrchestrationError('not_found', 'Tool not found')
+    /**
+     * This route runs a tool with no secret registry, so a result that carries provenance would
+     * reach Chat's model unprojected. Chat reads that content through its own commands instead.
+     */
+    if (isCopilotPrincipal(principal) && toolResultCarriesSecretProvenance(toolId)) {
+      throw new OrchestrationError(
+        'forbidden',
+        `${toolId} returns stored workspace content, which Chat reads through its files, knowledge and tables commands instead`
+      )
+    }
     assertNoUndeclaredInputs(tool, toolId, input.input)
 
     const selector = declaredCredentialSelector(tool)
diff --git a/apps/sim/lib/tool-execution/application/operations.ts b/apps/sim/lib/tool-execution/application/operations.ts
index 3dbe325c164..2092ffa78c9 100644
--- a/apps/sim/lib/tool-execution/application/operations.ts
+++ b/apps/sim/lib/tool-execution/application/operations.ts
@@ -37,5 +37,6 @@ export const toolExecutionOperations = {
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
diff --git a/apps/sim/lib/uploads/contexts/organization-assistant/application.ts b/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
index a3b85aa3518..3f35a04e310 100644
--- a/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
+++ b/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
@@ -128,6 +128,7 @@ export async function finalizeOrganizationAssistantAttachment(
 
 const organizationAttachmentReadOperation = defineOrganizationOperation({
   id: 'organization.chat.attachments.read',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'copilot.use',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
index 361c892e259..6fa377e1621 100644
--- a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
@@ -28,14 +28,15 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
   },
 }))
 
+import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
-import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
 import { runCli } from '@/lib/mothership/agent-cli/run-cli'
 import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
 import { WORKSPACE_FILE_STORAGE_CLEANUP_OUTBOX_EVENT } from '@/lib/uploads/contexts/workspace/file-outbox-events'
 import {
   deleteWorkspaceFileVersion,
@@ -635,9 +636,8 @@ describe('workspace file version history in PostgreSQL', () => {
     }
   )
 
+  /** Version downloads are direct-only, so Chat reaches history as text. */
   it.each([
-    ['named', 'download'],
-    ['anonymous', 'download'],
     ['named', 'read'],
     ['anonymous', 'read'],
     ['empty', 'read'],
@@ -685,52 +685,30 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const delivered: Array<{
-        stream: ReadableStream<Uint8Array>
-        provenance: WorkspaceFileSecretProvenance | undefined
-      }> = []
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        trackDownload: (stream, provenance) => {
-          delivered.push({ stream, provenance })
-        },
-        transport: async () => {
-          if (command === 'read') {
-            const result = await readWorkspaceFileVersionText.execute({
-              principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-              input: {
-                fileId: fixture.fileId,
-                assertedWorkspaceId: fixture.workspaceId,
-                version: 2,
-              },
-            })
-            return Response.json({
-              data: { ...presentWorkspaceFileText(result).data, version: result.version.version },
-            })
-          }
-          const result = await downloadWorkspaceFileVersion.execute({
-            principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-            input: { fileId: fixture.fileId, assertedWorkspaceId: fixture.workspaceId, version: 2 },
-          })
-          return new Response(result.stream, { headers: { 'content-type': result.contentType } })
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        ['files', 'versions', command, fixture.fileId, '2'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            ['files', 'versions', command, fixture.fileId, '2'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       expect(result.exitCode).toBe(0)
       expect(result.stdout).toContain(historicalContent)
@@ -740,7 +718,6 @@ describe('workspace file version history in PostgreSQL', () => {
       if (hasSecret) expect(projected.value).not.toContain(secret)
       else expect(projected.value).toBe(result.stdout)
       if (kind === 'named') expect(projected.value).toContain('{{FILE_TOKEN}}')
-      expect(delivered.map((delivery) => delivery.provenance)).toEqual([provenance])
     }
   )
 
@@ -781,32 +758,30 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        transport: async () => {
-          const result = await downloadWorkspaceFileVersion.execute({
-            principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-            input: { fileId: fixture.fileId, assertedWorkspaceId: fixture.workspaceId, version: 1 },
-          })
-          return new Response(result.stream, { headers: { 'content-type': result.contentType } })
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        ['files', 'versions', 'download', fixture.fileId, '1'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            ['files', 'versions', 'read', fixture.fileId, '1'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       if (kind === 'legacy') {
         expect(result.exitCode).toBe(0)
@@ -820,7 +795,7 @@ describe('workspace file version history in PostgreSQL', () => {
   )
 
   it.each(['current', 'historical'] as const)(
-    'redacts %s file contents when the real parser includes them in a CLI error',
+    'keeps %s file contents out of a real parser error',
     async (revision) => {
       const fixture = await seedFile('{}', 'json')
       const secret = 'ZZTOKEN99'
@@ -866,54 +841,37 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        transport: async () => {
-          try {
-            const result = await readWorkspaceFileVersionText.execute({
-              principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-              input: {
-                fileId: fixture.fileId,
-                assertedWorkspaceId: fixture.workspaceId,
-                version: 2,
-              },
-            })
-            return Response.json({
-              data: { ...presentWorkspaceFileText(result).data, version: result.version.version },
-            })
-          } catch (error) {
-            const response = v2FileErrorPolicies.concealResourceAuthorization.render(error)
-            if (!response) throw error
-            return response
-          }
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        revision === 'current'
-          ? ['files', 'read', fixture.fileId]
-          : ['files', 'versions', 'read', fixture.fileId, '2'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            revision === 'current'
+              ? ['files', 'read', fixture.fileId]
+              : ['files', 'versions', 'read', fixture.fileId, '2'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       expect(result.exitCode).not.toBe(0)
-      expect(result.stderr).toContain(secret)
-      const projected = projectResolvedSecretModelContent(result.stderr, registry)
-      expect(projected.safe).toBe(true)
-      if (!projected.safe) throw new Error('File parser error was withheld')
-      expect(projected.value).not.toContain(secret)
-      expect(projected.value).toContain('{{FILE_TOKEN}}')
+      /** The parser names the failure without quoting the input, so no fragment can survive. */
+      expect(result.stderr).toContain('Invalid JSON')
+      expect(result.stderr).not.toContain(secret)
     }
   )
 
diff --git a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
index cd82e241af9..7a79375ffd7 100644
--- a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
@@ -857,20 +857,75 @@ export async function markWorkspaceFileSecretProvenanceUnknown(
   })
 }
 
+interface BoundWorkspaceFileProvenanceRow {
+  key: string
+  context: string
+  fileContentUpdatedAt: Date
+  secretProvenanceVersion: number | null
+  provenanceContentUpdatedAt: Date | null
+  status: string | null
+  entries: unknown
+}
+
+/**
+ * Saving a chat upload changes its context but preserves its id, key, and bytes. Only a reader
+ * that captured the content revision may follow that promotion; the revision check still refuses an
+ * intervening content write, including on a legacy untracked file.
+ */
+function acceptsIdentityContext(identity: WorkspaceFileSecretProvenanceIdentity, context: string) {
+  return identity.context === 'mothership' && identity.contentUpdatedAt
+    ? context === 'mothership' || context === 'workspace'
+    : context === identity.context
+}
+
+/** Classifies one stored row for the exact identity a reader captured, failing closed on drift. */
+function bindWorkspaceFileSecretProvenance(
+  identity: WorkspaceFileSecretProvenanceIdentity,
+  row: BoundWorkspaceFileProvenanceRow | undefined
+): WorkspaceFileSecretProvenance {
+  if (!row || row.key !== identity.key || !acceptsIdentityContext(identity, row.context)) {
+    return { status: 'unknown' }
+  }
+  /**
+   * A version mismatch is not an absence: the caller is asking about content this file no longer
+   * holds, so nothing can be said about it and no policy relaxes that.
+   */
+  if (
+    identity.contentUpdatedAt &&
+    identity.contentUpdatedAt.getTime() !== row.fileContentUpdatedAt.getTime()
+  ) {
+    return { status: 'unknown' }
+  }
+  if (row.secretProvenanceVersion === null) return EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
+  if (row.secretProvenanceVersion !== 1) return { status: 'unknown' }
+  const bindingIsCurrent =
+    row.provenanceContentUpdatedAt?.getTime() === row.fileContentUpdatedAt.getTime()
+  if (!bindingIsCurrent || !isValidStoredEntries(row.entries, row.status))
+    return { status: 'unknown' }
+  /**
+   * Preserve absence separately from protection failures so consumers apply the matching policy.
+   */
+  if (row.status === 'unrecorded') return { status: 'unrecorded' }
+  if (row.status !== 'exact') return { status: 'unknown' }
+  return { status: 'exact', entries: deserializeExactEntriesFromStorage(row.entries) }
+}
+
+const boundProvenanceColumns = {
+  id: workspaceFiles.id,
+  key: workspaceFiles.key,
+  context: workspaceFiles.context,
+  fileContentUpdatedAt: workspaceFiles.contentUpdatedAt,
+  secretProvenanceVersion: workspaceFiles.secretProvenanceVersion,
+  provenanceContentUpdatedAt: workspaceFileSecretProvenance.contentUpdatedAt,
+  status: workspaceFileSecretProvenance.status,
+  entries: workspaceFileSecretProvenance.entries,
+}
+
 /** Reads provenance only when it still belongs to this exact canonical file id and storage key. */
 export async function getBoundWorkspaceFileSecretProvenance(
   workspaceId: string,
   identity: WorkspaceFileSecretProvenanceIdentity
 ): Promise<WorkspaceFileSecretProvenance> {
-  /**
-   * Saving a chat upload changes its context but preserves its id, key, and bytes. Only a reader
-   * that captured the content revision may follow that promotion; the revision check below still
-   * refuses an intervening content write, including on a legacy untracked file.
-   */
-  const contextCondition =
-    identity.context === 'mothership' && identity.contentUpdatedAt
-      ? inArray(workspaceFiles.context, ['mothership', 'workspace'])
-      : eq(workspaceFiles.context, identity.context)
   const [row] = await db
     .select({
       fileContentUpdatedAt: workspaceFiles.contentUpdatedAt,
@@ -889,37 +944,137 @@ export async function getBoundWorkspaceFileSecretProvenance(
         eq(workspaceFiles.id, identity.fileId),
         eq(workspaceFiles.key, identity.key),
         eq(workspaceFiles.workspaceId, workspaceId),
-        contextCondition
+        identity.context === 'mothership' && identity.contentUpdatedAt
+          ? inArray(workspaceFiles.context, ['mothership', 'workspace'])
+          : eq(workspaceFiles.context, identity.context)
         // Deliberately no deletedAt filter: `id` alone pins the exact row, and
         // recently-deleted/ reads are a real surface — excluding soft-deleted
         // rows made every archived file read as provenance-unknown and refused.
       )
     )
     .limit(1)
+  return bindWorkspaceFileSecretProvenance(
+    identity,
+    row && { ...row, key: identity.key, context: identity.context }
+  )
+}
 
-  if (!row) return { status: 'unknown' }
-  /**
-   * A version mismatch is not an absence: the caller is asking about content this file no longer
-   * holds, so nothing can be said about it and no policy relaxes that.
-   */
-  if (
-    identity.contentUpdatedAt &&
-    identity.contentUpdatedAt.getTime() !== row.fileContentUpdatedAt.getTime()
-  ) {
-    return { status: 'unknown' }
+/**
+ * Classifies many files a reader already resolved, one statement per thousand ids, with exactly the
+ * per-file binding of {@link getBoundWorkspaceFileSecretProvenance}: key and context are compared
+ * on the fetched row rather than in the query. Every requested id is answered.
+ */
+export async function getBoundWorkspaceFileSecretProvenanceByIdentity(
+  workspaceId: string,
+  identities: readonly WorkspaceFileSecretProvenanceIdentity[]
+): Promise<Map<string, WorkspaceFileSecretProvenance>> {
+  const rowsById = new Map<string, BoundWorkspaceFileProvenanceRow>()
+  const ids = [...new Set(identities.map((identity) => identity.fileId))]
+  for (let index = 0; index < ids.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    const rows = await db
+      .select(boundProvenanceColumns)
+      .from(workspaceFiles)
+      .leftJoin(
+        workspaceFileSecretProvenance,
+        eq(workspaceFileSecretProvenance.fileId, workspaceFiles.id)
+      )
+      .where(
+        and(
+          inArray(workspaceFiles.id, ids.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)),
+          /** As the single read: no deletedAt filter, so archived files keep their class. */
+          eq(workspaceFiles.workspaceId, workspaceId)
+        )
+      )
+    for (const row of rows) rowsById.set(row.id, row)
   }
-  if (row.secretProvenanceVersion === null) return EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
-  if (row.secretProvenanceVersion !== 1) return { status: 'unknown' }
-  const bindingIsCurrent =
-    row.provenanceContentUpdatedAt?.getTime() === row.fileContentUpdatedAt.getTime()
-  if (!bindingIsCurrent || !isValidStoredEntries(row.entries, row.status))
-    return { status: 'unknown' }
-  /**
-   * Preserve absence separately from protection failures so consumers apply the matching policy.
-   */
-  if (row.status === 'unrecorded') return { status: 'unrecorded' }
-  if (row.status !== 'exact') return { status: 'unknown' }
-  return { status: 'exact', entries: deserializeExactEntriesFromStorage(row.entries) }
+  return new Map(
+    identities.map((identity) => [
+      identity.fileId,
+      bindWorkspaceFileSecretProvenance(identity, rowsById.get(identity.fileId)),
+    ])
+  )
+}
+
+/**
+ * Classifies the bytes each file holds now, for a surface that serves whatever is current (a share
+ * link). Ids outside the workspace, or gone, read as unknown.
+ */
+export async function getCurrentWorkspaceFileSecretProvenance(
+  workspaceId: string,
+  fileIds: readonly string[]
+): Promise<Map<string, WorkspaceFileSecretProvenance>> {
+  const result = new Map<string, WorkspaceFileSecretProvenance>()
+  const ids = [...new Set(fileIds)]
+  for (let index = 0; index < ids.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    const rows = await db
+      .select(boundProvenanceColumns)
+      .from(workspaceFiles)
+      .leftJoin(
+        workspaceFileSecretProvenance,
+        eq(workspaceFileSecretProvenance.fileId, workspaceFiles.id)
+      )
+      .where(
+        and(
+          inArray(workspaceFiles.id, ids.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)),
+          eq(workspaceFiles.workspaceId, workspaceId)
+        )
+      )
+    for (const row of rows) {
+      const context =
+        row.context === 'mothership' || row.context === 'execution' ? row.context : 'workspace'
+      result.set(
+        row.id,
+        bindWorkspaceFileSecretProvenance(
+          { fileId: row.id, key: row.key, context, contentUpdatedAt: row.fileContentUpdatedAt },
+          row
+        )
+      )
+    }
+  }
+  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
+  return result
+}
+
+/**
+ * Classifies stored objects by key, for a reader that addresses bytes by the key a recording names
+ * (a run's output file) rather than by a canonical file id. The newest active row for a key wins,
+ * then its newest archived execution row. A key a superseded version still names is `unknown`. A
+ * key with no row at all is storage no file names (a direct upload, or legacy storage that
+ * predates metadata rows) and maps to `undefined`, which each caller treats as its surface does.
+ */
+export async function getStoredFileSecretProvenanceByKey(
+  workspaceId: string,
+  keys: readonly string[]
+): Promise<Map<string, WorkspaceFileSecretProvenance | undefined>> {
+  const uniqueKeys = [...new Set(keys.filter((key) => key.length > 0))]
+  const rows = await loadModelSafeWorkspaceFileRows(uniqueKeys)
+  const rowByKey = new Map(rows.map((row) => [row.key, row]))
+  const versionKeys = await findWorkspaceFileVersionKeys(
+    uniqueKeys.filter((key) => !rowByKey.has(key))
+  )
+  return new Map(
+    uniqueKeys.map((key): [string, WorkspaceFileSecretProvenance | undefined] => {
+      const row = rowByKey.get(key)
+      if (!row) return [key, versionKeys.has(key) ? { status: 'unknown' } : undefined]
+      if (row.workspaceId !== workspaceId) return [key, { status: 'unknown' }]
+      /** Other stores keep their own provenance, as the attachment filter has always treated them. */
+      if (
+        row.context !== 'workspace' &&
+        row.context !== 'mothership' &&
+        row.context !== 'execution'
+      ) {
+        return [key, { status: 'unrecorded' }]
+      }
+      const context = row.context
+      return [
+        key,
+        bindWorkspaceFileSecretProvenance(
+          { fileId: key, key, context, contentUpdatedAt: row.fileContentUpdatedAt },
+          row
+        ),
+      ]
+    })
+  )
 }
 
 /** Batch-loads classifications already bound to exact, authorized file metadata snapshots. */
@@ -1129,7 +1284,7 @@ export async function importWorkspaceFileSecretProvenanceForRuntime(args: {
 }
 
 /** Imports a classification already bound by an authorized read to its returned byte snapshot. */
-export async function importWorkspaceFileSnapshotProvenance(args: {
+async function importWorkspaceFileSnapshotProvenance(args: {
   workspaceId: string
   provenance: WorkspaceFileSecretProvenance
   resourceId?: string
@@ -1176,9 +1331,6 @@ export async function filterModelSafeWorkspaceFileAttachments<
   options: { workspaceId?: string } = {}
 ): Promise<TAttachment[]> {
   if (attachments.length === 0) return []
-  if (attachments.length > PROVENANCE_MAX_ENTRIES) {
-    throw new Error('Too many file attachments to verify secret provenance')
-  }
 
   const keys = [
     ...new Set(
@@ -1245,8 +1397,23 @@ function classifyModelSafeWorkspaceFileRow(
   return row.entries.length === 0 ? 'safe' : 'unsafe'
 }
 
+/** Ids per statement bound a query, never how many keys a caller may classify. */
 async function loadModelSafeWorkspaceFileRows(
   keys: readonly string[]
+): Promise<ModelSafeWorkspaceFileRow[]> {
+  const rows: ModelSafeWorkspaceFileRow[] = []
+  for (let index = 0; index < keys.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    rows.push(
+      ...(await loadModelSafeWorkspaceFileRowChunk(
+        keys.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)
+      ))
+    )
+  }
+  return rows
+}
+
+async function loadModelSafeWorkspaceFileRowChunk(
+  keys: readonly string[]
 ): Promise<ModelSafeWorkspaceFileRow[]> {
   return db
     .selectDistinctOn([workspaceFiles.key], {
@@ -1302,9 +1469,6 @@ export async function areModelSafeWorkspaceFileKeys(
 ): Promise<boolean> {
   const uniqueKeys = [...new Set(keys.filter((key) => key.length > 0))]
   if (uniqueKeys.length === 0) return true
-  if (uniqueKeys.length > PROVENANCE_MAX_ENTRIES) {
-    throw new Error('Too many file keys to verify secret provenance')
-  }
 
   const rows = await loadModelSafeWorkspaceFileRows(uniqueKeys)
   const rowKeys = new Set(rows.map((row) => row.key))
diff --git a/apps/sim/lib/workflow-tests/application/availability.ts b/apps/sim/lib/workflow-tests/application/availability.ts
index 26d9381bd50..87e2145de0d 100644
--- a/apps/sim/lib/workflow-tests/application/availability.ts
+++ b/apps/sim/lib/workflow-tests/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/workflow-tests/application/operations.ts b/apps/sim/lib/workflow-tests/application/operations.ts
index 09ffaf3ef0c..8b69124cc11 100644
--- a/apps/sim/lib/workflow-tests/application/operations.ts
+++ b/apps/sim/lib/workflow-tests/application/operations.ts
@@ -13,6 +13,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:read',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.read',
     minimumRole: 'read',
   }),
@@ -20,6 +21,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.create',
     minimumRole: 'write',
   }),
@@ -27,6 +29,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.update',
     minimumRole: 'write',
   }),
@@ -34,6 +37,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.run',
     minimumRole: 'write',
   }),
@@ -41,6 +45,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.delete',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
new file mode 100644
index 00000000000..140f7b9b392
--- /dev/null
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -0,0 +1,196 @@
+/**
+ * @vitest-environment node
+ */
+import type { Principal } from '@sim/auth/principal'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const provenance = vi.hoisted(() => ({ getStoredFileSecretProvenanceByKey: vi.fn() }))
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  async (importOriginal) => ({
+    ...(await importOriginal<
+      typeof import('@/lib/uploads/contexts/workspace/workspace-file-secret-provenance')
+    >()),
+    getStoredFileSecretProvenanceByKey: provenance.getStoredFileSecretProvenanceByKey,
+  })
+)
+
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import {
+  admitRunFiles,
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
+import type { UserFile } from '@/executor/types'
+
+const now = Date.now()
+function delegated(serviceId: string): Principal {
+  return {
+    kind: 'delegated',
+    serviceId,
+    subjectUserId: 'user-1',
+    workspaceId: 'workspace-1',
+    delegationId: 'delegation-1',
+    audience: 'sim:test',
+    issuedAt: new Date(now),
+    expiresAt: new Date(now + 60_000),
+  }
+}
+const CHAT = delegated('copilot')
+const EXECUTOR = delegated('executor')
+
+const ENTRY = { encryptedValue: 'ciphertext', sourceUserId: 'user-1' }
+
+/** Stored classification per run file key; a key absent from the map has no metadata row. */
+const STORED = new Map<string, unknown>([
+  ['key-clean', { status: 'exact', entries: [] }],
+  ['key-secret', { status: 'exact', entries: [ENTRY] }],
+  ['key-superseded', { status: 'unknown' }],
+  ['key-untracked', undefined],
+])
+
+/** Refuses unknown items and opaque views of items holding secrets, as Chat's registry gate does. */
+const GATE: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance: item, view }) =>
+        item.status !== 'unknown' &&
+        !(item.status === 'exact' && item.entries.length > 0 && view === 'opaque')
+    )
+  },
+}
+
+function runFile(name: string, extra: Partial<UserFile> = {}): UserFile {
+  return {
+    id: `file-${name}`,
+    name: `${name}.txt`,
+    url: `https://files.invalid/${name}`,
+    size: 4,
+    type: 'text/plain',
+    key: `key-${name}`,
+    ...extra,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  provenance.getStoredFileSecretProvenanceByKey.mockImplementation(
+    async (_workspaceId: string, keys: readonly string[]) =>
+      new Map(keys.filter((key) => STORED.has(key)).map((key) => [key, STORED.get(key)]))
+  )
+})
+
+describe('admitRunFiles', () => {
+  it('classifies each run file by the key the run recorded', async () => {
+    const files = ['clean', 'secret', 'superseded', 'untracked', 'unnamed'].map((name) =>
+      runFile(name)
+    )
+    const admitted = await observeContentDelivery(GATE, () =>
+      admitRunFiles(CHAT, 'workspace-1', files, 'opaque')
+    )
+    /**
+     * A key with no metadata row predates them (unrecorded, admitted); a key no lookup answered,
+     * or a superseded version, is unknown; secrets in an opaque view are refused.
+     */
+    expect([...admitted].sort()).toEqual(['file-clean', 'file-untracked'])
+  })
+
+  it('admits a secret-bearing file when the view is text egress can redact', async () => {
+    const admitted = await observeContentDelivery(GATE, () =>
+      admitRunFiles(CHAT, 'workspace-1', [runFile('secret')], 'complete')
+    )
+    expect([...admitted]).toEqual(['file-secret'])
+  })
+
+  it('admits every file for a caller no gate observes, without reading provenance', async () => {
+    const files = [runFile('superseded'), runFile('secret')]
+    const admitted = await admitRunFiles(EXECUTOR, 'workspace-1', files, 'opaque')
+    expect([...admitted].sort()).toEqual(['file-secret', 'file-superseded'])
+    expect(provenance.getStoredFileSecretProvenanceByKey).not.toHaveBeenCalled()
+  })
+})
+
+describe('withholdUnadmittedInlineFiles', () => {
+  it('strips base64 only from files Chat may not receive, keeping their descriptors', async () => {
+    const clean = runFile('clean', { base64: 'Y2xlYW4=' })
+    const secret = runFile('secret', { base64: 'c2VjcmV0' })
+    const output = {
+      result: { files: [clean, secret], note: 'done' },
+      count: 2,
+      at: new Date(now),
+    }
+    const withheld = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    const { base64: _secretBytes, ...secretDescriptor } = secret
+    expect(withheld).toEqual({
+      result: { files: [clean, secretDescriptor], note: 'done' },
+      count: 2,
+      at: output.at,
+    })
+    expect(withheld.at).toBe(output.at)
+    expect(output.result.files[1].base64).toBe('c2VjcmV0')
+  })
+
+  it('returns the very same value when every inlined file is admitted', async () => {
+    const output = { files: [runFile('clean', { base64: 'Y2xlYW4=' }), runFile('secret')] }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result).toBe(output)
+  })
+
+  it('withholds a file reached through shared references everywhere it appears', async () => {
+    const secret = runFile('secret', { base64: 'c2VjcmV0' })
+    const shared = { file: secret }
+    const output = { first: shared, second: shared, list: [secret] }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result.first).toBe(result.second)
+    expect(result.first.file).not.toHaveProperty('base64')
+    expect(result.list[0]).not.toHaveProperty('base64')
+  })
+
+  it('terminates on a cyclic output and withholds the file inside it', async () => {
+    const node: { file: UserFile; self?: unknown } = {
+      file: runFile('secret', { base64: 'c2VjcmV0' }),
+    }
+    node.self = node
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', { node })
+    )
+    expect(result.node.file).not.toHaveProperty('base64')
+  })
+
+  it('refuses refused bytes held by an object it cannot rebuild', async () => {
+    class Envelope {
+      constructor(readonly file: UserFile) {}
+    }
+    const output = { wrapped: new Envelope(runFile('secret', { base64: 'c2VjcmV0' })) }
+    await expect(
+      observeContentDelivery(GATE, () => withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('leaves every caller no gate observes byte-identical', async () => {
+    const output = { files: [runFile('superseded', { base64: 'b2xk' })] }
+    expect(await withholdUnadmittedInlineFiles(EXECUTOR, 'workspace-1', output)).toBe(output)
+  })
+})
+
+describe('inlinesRunFiles', () => {
+  it('disables inline bytes for Chat only on a run that streams its result', () => {
+    observeContentDelivery(GATE, () => {
+      expect(inlinesRunFiles(CHAT, true, 'stream')).toBe(false)
+      expect(inlinesRunFiles(CHAT, true, undefined)).toBe(false)
+      expect(inlinesRunFiles(CHAT, true, 'sync')).toBe(true)
+      expect(inlinesRunFiles(CHAT, undefined, 'stream')).toBeUndefined()
+    })
+    expect(inlinesRunFiles(EXECUTOR, true, 'stream')).toBe(true)
+  })
+})
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
new file mode 100644
index 00000000000..e2135031ab6
--- /dev/null
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -0,0 +1,122 @@
+import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  admitEach,
+  ContentRefusedError,
+  type ContentView,
+  isCopilotPrincipal,
+  mustClassifyContent,
+} from '@/lib/core/application/content-delivery'
+import { collectUserFilesById, isUserFileWithMetadata } from '@/lib/core/utils/user-file'
+import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { UserFile } from '@/executor/types'
+
+/**
+ * Admits each file a run produced on its own, classified by the storage key the run recorded, and
+ * returns the ids admitted. A caller no gate observes gets every id back without a provenance read.
+ */
+export async function admitRunFiles(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly UserFile[],
+  view: ContentView
+): Promise<Set<string>> {
+  const admitted = await admitEach(principal, files, async (items) => {
+    const provenance = await getStoredFileSecretProvenanceByKey(
+      workspaceId,
+      items.map((file) => file.key)
+    )
+    return items.map((file) => ({
+      kind: 'execution-file' as const,
+      id: file.id,
+      /** A run file no metadata row names predates them: an absence, audited, not taint. */
+      provenance: provenance.has(file.key)
+        ? (provenance.get(file.key) ?? { status: 'unrecorded' as const })
+        : { status: 'unknown' as const },
+      view,
+    }))
+  })
+  return new Set(admitted.map((file) => file.id))
+}
+
+function withoutUnadmittedBase64(
+  value: unknown,
+  admittedKeys: ReadonlySet<string>,
+  seen: WeakMap<object, unknown>
+): unknown {
+  if (!value || typeof value !== 'object') return value
+  const copied = seen.get(value)
+  if (copied !== undefined) return copied
+  if (isUserFileWithMetadata(value)) {
+    if (typeof value.base64 !== 'string' || admittedKeys.has(value.key)) return value
+    const { base64: _withheld, ...described } = value
+    seen.set(value, described)
+    return described
+  }
+  /** Each copy is registered before its children are walked, so a cycle resolves to the copy. */
+  if (Array.isArray(value)) {
+    const items: unknown[] = []
+    seen.set(value, items)
+    for (const item of value) items.push(withoutUnadmittedBase64(item, admittedKeys, seen))
+    return items
+  }
+  /**
+   * Only plain data is rebuilt. Another object (a stream, response or date) passes through
+   * untouched unless it carries refused inline bytes, which cannot be removed without rebuilding
+   * it, so the result is refused instead.
+   */
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) {
+    for (const file of collectUserFilesById(value).values()) {
+      if (typeof file.base64 === 'string' && !admittedKeys.has(file.key)) {
+        throw new ContentRefusedError('execution-file')
+      }
+    }
+    return value
+  }
+  const record: Record<string, unknown> = prototype === null ? Object.create(null) : {}
+  seen.set(value, record)
+  for (const [key, item] of Object.entries(value)) {
+    record[key] = withoutUnadmittedBase64(item, admittedKeys, seen)
+  }
+  return record
+}
+
+/**
+ * Keeps an output's inlined file bytes only for files admitted on their own; another file keeps
+ * its descriptor without `base64`, and stays downloadable through the run's file route, which is
+ * gated per file. Inlined base64 is opaque to text redaction.
+ */
+export async function withholdUnadmittedInlineFiles<T>(
+  principal: Principal,
+  workspaceId: string,
+  value: T
+): Promise<T> {
+  /** Only Chat is classified; every other caller keeps its output unwalked. */
+  if (!isCopilotPrincipal(principal)) {
+    await admitContent(principal, [])
+    return value
+  }
+  const inlined = [...collectUserFilesById(value).values()].filter(
+    (file) => typeof file.base64 === 'string'
+  )
+  const admittedIds = await admitRunFiles(principal, workspaceId, inlined, 'opaque')
+  if (admittedIds.size === inlined.length) return value
+  const admittedKeys = new Set(
+    inlined.filter((file) => admittedIds.has(file.id)).map((file) => file.key)
+  )
+  return withoutUnadmittedBase64(value, admittedKeys, new WeakMap()) as T
+}
+
+/**
+ * Inline base64 a streamed run emits cannot be withheld per file once it is on the wire, so Chat
+ * receives inline file bytes only from a run that returns its whole result at once; every file
+ * stays downloadable through the run's file route, gated per file.
+ */
+export function inlinesRunFiles(
+  principal: Principal,
+  requested: boolean | undefined,
+  mode: string | undefined
+): boolean | undefined {
+  return mode !== 'sync' && requested && mustClassifyContent(principal) ? false : requested
+}
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
index c81b3be8350..b6569f517fa 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
@@ -10,11 +10,19 @@ import {
   workflowContextMockFns,
 } from '@sim/testing/mocks/workflow-context.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   getRunFiles: vi.fn(),
 }))
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
@@ -27,8 +35,31 @@ vi.mock('@/lib/workflows/executor/execution-run-files', () => ({
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
 import { Readable } from 'node:stream'
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  isCopilotPrincipal,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { downloadWorkflowRunFileStream } from '@/lib/workflows/application/download-workflow-run-file'
 
+/** Chat's gate with no registry: it admits only a file with no recorded secret. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+
+/** Runs as each surface does: Chat under its gate, every other caller unobserved. */
+function download(principal: Principal, args = input()) {
+  const execute = () => downloadWorkflowRunFileStream.execute({ principal, input: args })
+  return isCopilotPrincipal(principal) ? observeContentDelivery(secretFreeGate, execute) : execute()
+}
+
 const mockDownloadFileStream = storageServiceMockFns.mockDownloadFileStream
 
 const mockResolvePermission = workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission
@@ -98,16 +129,50 @@ describe('downloadWorkflowRunFileStream', () => {
     )
     mocks.getRunFiles.mockResolvedValue(terminalRun())
     mockDownloadFileStream.mockResolvedValue(Readable.from([Buffer.from('pdf')]))
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, { status: 'exact', entries: [] }]])
+    )
   })
 
   it.each(principals)('allows $kind at the read role', async (principal) => {
-    const result = await downloadWorkflowRunFileStream.execute({ principal, input: input() })
+    const result = await download(principal)
 
     expect(result.file.id).toBe(FILE_ID)
     expect(result.contentType).toBe('application/pdf')
     expect(result.contentLength).toBe(3)
   })
 
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }] },
+  ])('refuses Chat a run file its gate refuses, before opening it: %j', async (provenance) => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, provenance]])
+    )
+    await expect(download(principals[3])).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey
+    ).toHaveBeenCalledWith('workspace-1', [FILE_KEY])
+    expect(mockDownloadFileStream).not.toHaveBeenCalled()
+  })
+
+  it('classifies storage no metadata row names as unrecorded, admitting it', async () => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, undefined]])
+    )
+    expect((await download(principals[3])).file.id).toBe(FILE_ID)
+  })
+
+  it('serves a caller outside Chat without classifying', async () => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, { status: 'unknown' }]])
+    )
+    expect((await download(principals[0])).file.id).toBe(FILE_ID)
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey
+    ).not.toHaveBeenCalled()
+  })
+
   /**
    * `HEAD` on this route runs the authorization phase alone. With the file
    * lookup downstream of it, `authorize` succeeded for any id at all, so a
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
index d8bbac08b4b..b2faf42a55b 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
@@ -1,9 +1,11 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { nodeReadableToWebStream } from '@/lib/core/utils/node-stream'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { inferContextFromKey } from '@/lib/uploads/utils/file-utils'
+import { admitRunFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import {
   type ActiveWorkflowRunApplicationContext,
@@ -91,12 +93,15 @@ async function resolveDownloadWorkflowRunFileContext(
 
 async function executeDownloadWorkflowRunFile({
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof workflowOperations.downloadRunFile,
   DownloadWorkflowRunFileInput,
   DownloadWorkflowRunFileContext
 >): Promise<DownloadWorkflowRunFileResult> {
   const { file } = context
+  const admitted = await admitRunFiles(principal, context.workspaceId, [file], 'complete')
+  if (!admitted.has(file.id)) throw new ContentRefusedError('execution-file')
 
   /**
    * The storage context is inferred from the key rather than read off the
diff --git a/apps/sim/lib/workflows/application/execute-manual-workflow.ts b/apps/sim/lib/workflows/application/execute-manual-workflow.ts
index d949bea2f5b..5f51a6a5939 100644
--- a/apps/sim/lib/workflows/application/execute-manual-workflow.ts
+++ b/apps/sim/lib/workflows/application/execute-manual-workflow.ts
@@ -1,6 +1,10 @@
 import { requirePrincipalSubjectUserId, type WorkflowExecutionPrincipal } from '@sim/auth/principal'
 import { mergeSubblockStateWithValues } from '@sim/workflow-persistence/subblocks'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import {
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
 import type { ExecuteWorkflowInput } from '@/lib/workflows/application/execute-workflow'
@@ -133,7 +137,11 @@ function executionServiceInput(params: {
     callChain: params.input.callChain,
     useAuthenticatedUserAsActor: true,
     workflowRecord: params.context.workflow,
-    includeFileBase64: params.input.includeFileBase64,
+    includeFileBase64: inlinesRunFiles(
+      params.principal,
+      params.input.includeFileBase64,
+      params.input.mode
+    ),
     base64MaxBytes: params.input.base64MaxBytes,
     selectedOutputs: params.input.selectedOutputs,
     stopAfterBlockId: params.input.stopAfterBlockId,
@@ -193,11 +201,12 @@ export const executeManualWorkflowOperation = defineAuthorizedWorkflowUseCase({
       throw new OrchestrationError('validation', validation.error)
     }
 
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       ...executionServiceInput({ principal, context, input, draftState: state }),
       input: executionInput,
       triggerBlockId: selected.triggerBlockId,
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
 
@@ -222,7 +231,7 @@ export const executeManualWorkflowFromBlockOperation = defineAuthorizedWorkflowU
       )
     }
 
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       ...executionServiceInput({ principal, context, input, draftState: state }),
       input: input.input,
       runFromBlock: {
@@ -231,5 +240,6 @@ export const executeManualWorkflowFromBlockOperation = defineAuthorizedWorkflowU
         sourceExecutionId: input.sourceRunId,
       },
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/application/execute-workflow.ts b/apps/sim/lib/workflows/application/execute-workflow.ts
index d7c8f74aed4..5f50a2d665d 100644
--- a/apps/sim/lib/workflows/application/execute-workflow.ts
+++ b/apps/sim/lib/workflows/application/execute-workflow.ts
@@ -1,5 +1,9 @@
 import type { Principal } from '@sim/auth/principal'
 import { resolvePrincipalAttribution } from '@sim/auth/principal'
+import {
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -41,7 +45,7 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
     const attribution = resolvePrincipalAttribution(principal, {
       workspaceBillingOwnerUserId: context.billedAccountUserId,
     })
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       workflowId: context.workflowId,
       principal,
       userId: attribution.attributedUserId,
@@ -52,7 +56,7 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
       callChain: input.callChain,
       useAuthenticatedUserAsActor: authenticatesExecutionCredentials(principal),
       workflowRecord: context.workflow,
-      includeFileBase64: input.includeFileBase64,
+      includeFileBase64: inlinesRunFiles(principal, input.includeFileBase64, input.mode),
       base64MaxBytes: input.base64MaxBytes,
       selectedOutputs: input.selectedOutputs,
       rateLimitCounter: input.mode === 'async' ? 'async' : 'sync',
@@ -63,5 +67,6 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
       includeThinking: input.includeThinking,
       includeToolCalls: input.includeToolCalls,
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/application/operations.ts b/apps/sim/lib/workflows/application/operations.ts
index 2ac6852a2bd..dec0ed036fd 100644
--- a/apps/sim/lib/workflows/application/operations.ts
+++ b/apps/sim/lib/workflows/application/operations.ts
@@ -45,6 +45,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: reading a workflow is governed by workspace role, not by a group capability
@@ -54,6 +55,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   /** Full diagnostics retain the caller's subject for protected reference and secret reads. */
@@ -64,6 +66,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -73,6 +76,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: inspecting saved tool bindings reads workflow content; protected dependencies reauthorize separately
@@ -81,6 +85,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow module has no hide key, so creating a workflow is governed by workspace role alone
@@ -90,6 +95,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: renaming or re-describing a workflow is governed by workspace role
@@ -99,6 +105,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -123,6 +130,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -150,6 +158,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: restoring a soft-deleted workflow is governed by workspace role
@@ -159,6 +168,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a workflow's run policy is workspace-admin configuration; no group capability withholds it
@@ -176,6 +186,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: moving workflows between folders is placement, governed by workspace role
@@ -185,6 +196,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: duplicating copies a graph the caller may already read into the same workspace, so it crosses no capability boundary
@@ -194,6 +206,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -202,6 +215,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -211,6 +225,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -219,6 +234,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a single block is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -227,6 +243,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: deleting a workflow is governed by workspace role
@@ -236,6 +253,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; reading it is governed by workspace role
@@ -245,6 +263,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -254,6 +273,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -263,6 +283,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -272,6 +293,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   deploy: defineWorkspaceOperation({
@@ -280,6 +302,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   undeploy: defineWorkspaceOperation({
@@ -288,6 +311,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   deployChat: defineWorkspaceOperation({
@@ -296,6 +320,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -313,6 +338,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -322,6 +348,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: reverting the draft to an earlier version edits workflow content; deployment capabilities govern what is served, not what is edited
@@ -331,6 +358,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a version's name and description are metadata on workflow content, governed by workspace role
@@ -340,6 +368,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: comparing deployment versions reads workflow content, governed by workspace role
@@ -349,6 +378,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: version history is workflow content, governed by workspace role
@@ -358,6 +388,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: version history is workflow content, governed by workspace role
@@ -367,6 +398,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: an export returns the graph its reader can already open; logs.export withholds execution logs, not definitions
@@ -376,6 +408,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -387,6 +420,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: importing is workflow authoring governed by workspace role; the blocks the payload carries are judged against allowedIntegrations before they are persisted
@@ -396,6 +430,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow from an authenticated surface is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
@@ -405,6 +440,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a manual run is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
@@ -414,6 +450,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'sourced',
     principalKinds: ['personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -424,6 +461,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'sourced',
     principalKinds: ['personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -434,6 +472,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: execution history is governed by workspace role; logs.cost and logs.trace_spans withhold fields inside a run, not the right to read one
@@ -443,6 +482,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a paused execution's detail is pause points and resume state, not the run's execution data — the fields logs.cost and logs.trace_spans withhold never appear here
@@ -452,6 +492,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -482,6 +523,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: stopping a run already in flight is governed by workspace role
@@ -491,6 +533,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: answering a paused run is governed by workspace role
@@ -500,6 +543,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/workflows/application/read-workflow-run.ts b/apps/sim/lib/workflows/application/read-workflow-run.ts
index 5e82ce9c77e..73444cc90dc 100644
--- a/apps/sim/lib/workflows/application/read-workflow-run.ts
+++ b/apps/sim/lib/workflows/application/read-workflow-run.ts
@@ -1,10 +1,12 @@
 import { isValidUuid } from '@sim/utils/id'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   FUNCTIONAL_OUTPUTS_UNAVAILABLE_MESSAGE,
   FunctionalOutputsUnavailableError,
 } from '@/lib/logs/execution/functional-outputs'
 import { logProjectionSubjectUserId } from '@/lib/logs/projection'
+import { admitRunFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowRunApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -61,6 +63,8 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
       assertedWorkflowId: input.workflowId,
     }),
   async execute({ principal, context, input }) {
+    /** Only inlined file bytes are sourced content here; they are admitted per file below. */
+    await admitContent(principal, [])
     try {
       /**
        * The projection subject, not an attribution: a workspace API key
@@ -122,12 +126,24 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
           workflowId: context.workflowId,
           runId: context.runId,
         })
+        const includeBase64 = input.includeFileBase64 === true
+        /** Inlined base64 is opaque to text redaction, so each file is inlined only if admitted. */
+        const inlineable =
+          runFiles && includeBase64
+            ? await admitRunFiles(
+                principal,
+                context.workspaceId,
+                [...runFiles.filesById.values()],
+                'opaque'
+              )
+            : undefined
         files = runFiles
           ? await describeWorkflowRunFiles(runFiles.filesById, {
               workflowId: context.workflowId,
               runId: context.runId,
-              includeBase64: input.includeFileBase64 === true,
+              includeBase64,
               base64MaxBytes: input.base64MaxBytes,
+              ...(inlineable ? { inlineable } : {}),
             })
           : []
       }
diff --git a/apps/sim/lib/workflows/application/resume-run.ts b/apps/sim/lib/workflows/application/resume-run.ts
index c21f1972da9..c2f04d6af6d 100644
--- a/apps/sim/lib/workflows/application/resume-run.ts
+++ b/apps/sim/lib/workflows/application/resume-run.ts
@@ -1,4 +1,5 @@
 import { resolvePrincipalAttribution } from '@sim/auth/principal'
+import { withholdUnadmittedInlineFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowRunApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -22,7 +23,7 @@ export const resumeWorkflowRun = defineAuthorizedWorkflowUseCase({
     const attribution = resolvePrincipalAttribution(principal, {
       workspaceBillingOwnerUserId: context.billedAccountUserId,
     })
-    return executeResumeWorkflow({
+    const result = await executeResumeWorkflow({
       workflowId: context.workflowId,
       executionId: context.runId,
       contextId: input.contextId,
@@ -33,5 +34,7 @@ export const resumeWorkflowRun = defineAuthorizedWorkflowUseCase({
       pollingSurface: 'v2',
       allowStreaming: false,
     })
+    /** A resumed run inlines its output files, which are admitted per file like a fresh run's. */
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/custom-blocks/application/settings.ts b/apps/sim/lib/workflows/custom-blocks/application/settings.ts
index ff06fae8128..2a33bce0c97 100644
--- a/apps/sim/lib/workflows/custom-blocks/application/settings.ts
+++ b/apps/sim/lib/workflows/custom-blocks/application/settings.ts
@@ -36,6 +36,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.list',
     minimumRole: 'read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   publish: defineWorkspaceOperation({
@@ -43,6 +44,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.publish',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   update: defineWorkspaceOperation({
@@ -50,6 +52,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.update',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   delete: defineWorkspaceOperation({
@@ -57,6 +60,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.delete',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   usages: defineWorkspaceOperation({
@@ -64,6 +68,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.usages',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 const authorizationOptions = { delegation: { audience: 'sim:settings', isWithinScope: () => true } }
diff --git a/apps/sim/lib/workflows/executor/execution-run-files.ts b/apps/sim/lib/workflows/executor/execution-run-files.ts
index 8b1ed18ec9c..f67d85db851 100644
--- a/apps/sim/lib/workflows/executor/execution-run-files.ts
+++ b/apps/sim/lib/workflows/executor/execution-run-files.ts
@@ -142,6 +142,8 @@ export interface DescribeWorkflowRunFilesOptions {
   includeBase64: boolean
   /** Inline ceiling per file. Clamped to the executor's own inline limit. */
   base64MaxBytes?: number
+  /** Files whose bytes may be inlined; any other file is described with `base64: null`. */
+  inlineable?: ReadonlySet<string>
 }
 
 /**
@@ -184,9 +186,12 @@ export async function describeWorkflowRunFiles(
   if (!options.includeBase64) {
     return files.map((file) => describe(file, null))
   }
+  const inlined = options.inlineable
+    ? files.filter((file) => options.inlineable?.has(file.id))
+    : files
 
   let declaredBytes = 0
-  for (const file of files) {
+  for (const file of inlined) {
     const downloadPath = workflowRunFileDownloadPath(options.workflowId, options.runId, file.id)
     if (file.size > cap) {
       throw new OrchestrationError(
@@ -202,6 +207,7 @@ export async function describeWorkflowRunFiles(
 
   let inlinedBytes = 0
   return mapWithConcurrency(files, INLINE_RUN_FILE_CONCURRENCY, async (file) => {
+    if (options.inlineable && !options.inlineable.has(file.id)) return describe(file, null)
     let content: Buffer
     try {
       content = await downloadFile({
diff --git a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
index 60790ff9539..8b4462944e8 100644
--- a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
+++ b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
@@ -30,6 +30,7 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
   },
 }))
 
+import { ContentDeliveryUnobservedError } from '@/lib/core/application/content-delivery'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
@@ -47,7 +48,6 @@ import {
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/download-workspace-file'
-import { WorkspaceFileDeliveryUnobservedError } from '@/lib/workspace-files/application/file-delivery-observer'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import '@/app/api/v2/files/[fileId]/text/route'
@@ -208,7 +208,7 @@ describe('chat-delegated file version history', () => {
     expect(projected.value).toContain('token=[REDACTED_SECRET]')
 
     const untracked = await chatTransport(fixture, fixture.bobId)(url)
-    expect(untracked.status).toBe(503)
+    expect(untracked.status).toBe(403)
     const refusal = await untracked.text()
     expect(refusal).not.toContain(SECRET)
     expect(refusal).toContain('provenance is unavailable')
@@ -287,7 +287,7 @@ describe('chat-delegated file version history', () => {
     expect((await versionRows(fixture.fileId)).map((row) => row.version)).toEqual([1, 2, 3])
   })
 
-  it('refuses a delegated version read that no delivery observer records', async () => {
+  it('refuses a delegated version read that no content gate admits', async () => {
     const fixture = await seedVersionedFile()
 
     const response = await chatTransport(fixture, fixture.bobId, undefined, { observer: false })(
@@ -412,15 +412,15 @@ describe('chat-delegated file version history', () => {
     expect(projected.value).toContain('token=[REDACTED_SECRET]')
 
     const untracked = await chatTransport(fixture, fixture.bobId)(url)
-    expect(untracked.status).toBe(503)
+    expect(untracked.status).toBe(403)
     expect(await untracked.text()).not.toContain(SECRET)
   })
 
   /**
-   * The current-file text read and download admitted Chat whether or not a delivery observer would
+   * The current-file text read and download admitted Chat whether or not a content gate would
    * record the secret provenance of the bytes; only the transport Chat composes today installed one.
    */
-  describe('current-file reads without a delivery observer', () => {
+  describe('current-file reads without a content gate', () => {
     async function revertToSecretVersion(fixture: Awaited<ReturnType<typeof seedVersionedFile>>) {
       const reverted = await chatTransport(fixture, fixture.aliceId)(
         `/api/v2/files/${fixture.fileId}/versions/2/revert`,
@@ -475,7 +475,7 @@ describe('chat-delegated file version history', () => {
       )
 
       await expect(inWorkspace(fixture, () => download(fixture, principal))).rejects.toThrow(
-        WorkspaceFileDeliveryUnobservedError
+        ContentDeliveryUnobservedError
       )
     })
 
diff --git a/apps/sim/lib/workspace-files/api/route-policies.ts b/apps/sim/lib/workspace-files/api/route-policies.ts
index 031cdba674a..c8b62bd6020 100644
--- a/apps/sim/lib/workspace-files/api/route-policies.ts
+++ b/apps/sim/lib/workspace-files/api/route-policies.ts
@@ -6,12 +6,7 @@ import {
 } from '@/lib/api/server/routes'
 import { ArchiveError, statusForArchiveError } from '@/lib/uploads/archive'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
-import { WorkspaceFileDeliveryUnobservedError } from '@/lib/workspace-files/application/file-delivery-observer'
-import {
-  v2CaughtOrchestrationError,
-  v2Error,
-  v2ErrorForOrchestration,
-} from '@/app/api/v2/lib/response'
+import { v2CaughtOrchestrationError, v2ErrorForOrchestration } from '@/app/api/v2/lib/response'
 
 export const internalSessionOrExecutorAuth = createInternalSessionOrExecutorAuth({
   audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
@@ -34,12 +29,6 @@ export const v2FileErrorPolicies = {
   default: v2OrchestrationErrorPolicy,
   concealResourceAuthorization: createV2ResourceConcealmentPolicy({
     notFoundMessage: 'File not found',
-    render(error) {
-      if (error instanceof WorkspaceFileDeliveryUnobservedError) {
-        return v2Error('SERVICE_UNAVAILABLE', error.message)
-      }
-      return v2CaughtOrchestrationError(error)
-    },
   }) satisfies V2ErrorPolicy,
   /**
    * Resource-ID upload controls conceal the *authorization* failure as absence,
diff --git a/apps/sim/lib/workspace-files/application/admit-file-content.ts b/apps/sim/lib/workspace-files/application/admit-file-content.ts
new file mode 100644
index 00000000000..e502565d662
--- /dev/null
+++ b/apps/sim/lib/workspace-files/application/admit-file-content.ts
@@ -0,0 +1,136 @@
+import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  admitEach,
+  ContentRefusedError,
+  type ContentView,
+  mustClassifyContent,
+  requireAdmittedContent,
+} from '@/lib/core/application/content-delivery'
+import {
+  getBoundWorkspaceFileSecretProvenance,
+  getBoundWorkspaceFileSecretProvenanceByIdentity,
+  type WorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenanceIdentity,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+
+/** What a classification is bound to; a workspace file record satisfies it. */
+interface ClassifiableFile {
+  id: string
+  key: string
+  storageContext?: WorkspaceFileSecretProvenanceIdentity['context']
+  contentUpdatedAt?: Date | null
+}
+
+/** The identity a classification is bound to: these exact bytes of this exact canonical file. */
+function workspaceFileProvenanceIdentity(
+  file: ClassifiableFile
+): WorkspaceFileSecretProvenanceIdentity {
+  return {
+    fileId: file.id,
+    key: file.key,
+    context: file.storageContext ?? 'workspace',
+    contentUpdatedAt: file.contentUpdatedAt ?? undefined,
+  }
+}
+
+/**
+ * Admits one file's content before its bytes load, refusing it with a `403` when the surface's
+ * gate does. `provenance` is passed when the caller holds a classification bound to a snapshot
+ * other than the current file, such as a historical version. A caller no gate observes is admitted
+ * without a provenance read.
+ */
+export async function requireAdmittedWorkspaceFile(
+  principal: Principal,
+  workspaceId: string,
+  file: ClassifiableFile,
+  view: ContentView,
+  provenance?: WorkspaceFileSecretProvenance
+): Promise<void> {
+  if (!mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return
+  }
+  await requireAdmittedContent(principal, {
+    kind: 'workspace-file',
+    id: file.id,
+    provenance:
+      provenance ??
+      (await getBoundWorkspaceFileSecretProvenance(
+        workspaceId,
+        workspaceFileProvenanceIdentity(file)
+      )),
+    view,
+  })
+}
+
+/**
+ * Admits the other files a render embedded, after it ran and before its bytes leave. A render is
+ * one output its contributors cannot be separated from, so it is admitted only when every one is.
+ */
+export async function admitContributors(
+  principal: Principal,
+  workspaceId: string,
+  contributors: readonly WorkspaceFileSecretProvenanceIdentity[] | undefined,
+  view: ContentView
+): Promise<boolean> {
+  if (!contributors?.length || !mustClassifyContent(principal)) return true
+  const provenance = await getBoundWorkspaceFileSecretProvenanceByIdentity(
+    workspaceId,
+    contributors
+  )
+  const sources = contributors.map((identity) => ({
+    kind: 'workspace-file' as const,
+    id: identity.fileId,
+    provenance: provenance.get(identity.fileId) ?? { status: 'unknown' as const },
+    view,
+  }))
+  return (await admitContent(principal, sources)).refused.length === 0
+}
+
+/** {@link admitContributors} for a single render: a refused contributor refuses it with a `403`. */
+export async function requireAdmittedContributors(
+  ...args: Parameters<typeof admitContributors>
+): Promise<void> {
+  if (!(await admitContributors(...args))) {
+    throw new ContentRefusedError('workspace-file')
+  }
+}
+
+/**
+ * Admits each of many files on its own, classifying all of them in one batch, and returns the ids
+ * admitted. A caller no gate observes gets every id back without a provenance read.
+ */
+export async function admitWorkspaceFileIdentities(
+  principal: Principal,
+  workspaceId: string,
+  identities: readonly WorkspaceFileSecretProvenanceIdentity[],
+  view: ContentView
+): Promise<Set<string>> {
+  const admitted = await admitEach(principal, identities, async (items) => {
+    const provenance = await getBoundWorkspaceFileSecretProvenanceByIdentity(workspaceId, items)
+    return items.map((identity) => ({
+      kind: 'workspace-file' as const,
+      id: identity.fileId,
+      provenance: provenance.get(identity.fileId) ?? { status: 'unknown' as const },
+      view,
+    }))
+  })
+  return new Set(admitted.map((identity) => identity.fileId))
+}
+
+/** {@link admitWorkspaceFileIdentities} over file records, returning the admitted records in order. */
+export async function admitWorkspaceFiles<F extends ClassifiableFile>(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly F[],
+  view: ContentView
+): Promise<F[]> {
+  const admitted = await admitWorkspaceFileIdentities(
+    principal,
+    workspaceId,
+    files.map(workspaceFileProvenanceIdentity),
+    view
+  )
+  return files.filter((file) => admitted.has(file.id))
+}
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
index ddb450623fe..58a2e764342 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
@@ -9,6 +9,10 @@ import {
   permissionGroupsResolveMockFns,
 } from '@sim/testing/mocks/permission-groups-resolve.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import {
   workspaceUploadsMock,
   workspaceUploadsMockFns,
@@ -39,6 +43,19 @@ vi.mock('@/lib/uploads/utils/doc-not-ready', () => ({
   isDocNotReadyError: mockIsDocNotReady,
 }))
 vi.mock('@sim/audit', () => auditMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+
+const mockProvenance =
+  workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity
 
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
@@ -77,6 +94,17 @@ const workspace = {
   billedAccountUserId: 'billing-owner',
 }
 
+/** Chat's gate with no registry: an archive is opaque, so only secret-free files are admitted. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+
 function file(id: string, name: string, folderId: string | null = null, size = 10) {
   return { id, name, folderId, size, type: 'application/octet-stream', key: `key-${id}` }
 }
@@ -101,16 +129,68 @@ describe('downloadWorkspaceFileItems', () => {
     mockIsRenderable.mockReturnValue(false)
     mockIsDocNotReady.mockReturnValue(false)
     mockGetUserPermissionConfig.mockResolvedValue(null)
+    mockProvenance.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(identities.map((identity) => [identity.fileId, { status: 'exact', entries: [] }]))
+    )
   })
 
   it('allows a file-scoped delegated principal to download its one explicit file', async () => {
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: delegatedPrincipal,
+        input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
+      })
+    )
+
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+    expect(mockResolvePermission).toHaveBeenCalledOnce()
+    expect(mockProvenance).toHaveBeenCalledWith('ws-1', [
+      expect.objectContaining({ fileId: 'f1', key: 'key-f1' }),
+    ])
+  })
+
+  it('leaves out of a Chat archive each file its gate refuses, keeping the rest', async () => {
+    mockListFiles.mockResolvedValue([file('f1', 'clean.txt'), file('f2', 'secret.txt')])
+    mockProvenance.mockResolvedValue(
+      new Map([
+        ['f1', { status: 'exact', entries: [] }],
+        ['f2', { status: 'unknown' }],
+      ])
+    )
+    const chat = createDelegatedPrincipal({
+      subjectUserId: 'u1',
+      workspaceId: 'ws-1',
+      audience: 'sim:workspace-files',
+    })
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: chat,
+        input: { workspaceId: 'ws-1', fileIds: ['f1', 'f2'], folderIds: [] },
+      })
+    )
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+  })
+
+  it('refuses a Chat archive whose every file its gate refuses', async () => {
+    mockProvenance.mockResolvedValue(new Map([['f1', { status: 'unknown' }]]))
+    await expect(
+      observeContentDelivery(secretFreeGate, () =>
+        downloadWorkspaceFileItems.execute({
+          principal: delegatedPrincipal,
+          input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
+        })
+      )
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('archives every selected file for a caller outside Chat without classifying', async () => {
     const result = await downloadWorkspaceFileItems.execute({
-      principal: delegatedPrincipal,
+      principal,
       input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
     })
-
     expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
-    expect(mockResolvePermission).toHaveBeenCalledOnce()
+    expect(mockProvenance).not.toHaveBeenCalled()
   })
 
   it.each([
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index 011dabaf0c7..e7a3ecad334 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -3,6 +3,7 @@ import {
   type AuthorizedWorkspaceUseCaseContext,
   capabilityGovernedPrincipalUserId,
 } from '@/lib/core/application'
+import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { parseFolderPath } from '@/lib/folders/paths'
@@ -20,6 +21,10 @@ import {
   MAX_RENDERED_DOCUMENT_BYTES,
   needsRenderedArtifact,
 } from '@/lib/uploads/utils/file-utils'
+import {
+  admitContributors,
+  admitWorkspaceFiles,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -157,18 +162,25 @@ async function executeDownloadWorkspaceFileItems({
     folders
   )
   const requestedFileIds = new Set(fileIds)
-  const filesToZip = files.filter(
+  const selectedFiles = files.filter(
     (file) =>
       requestedFileIds.has(file.id) ||
       (file.folderId != null && selectedFolderIds.has(file.folderId))
   )
 
-  if (filesToZip.length === 0) validationError('No files selected for download')
-  if (filesToZip.length > MAX_ZIP_DOWNLOAD_FILES) {
+  if (selectedFiles.length === 0) validationError('No files selected for download')
+  if (selectedFiles.length > MAX_ZIP_DOWNLOAD_FILES) {
     validationError(
       `Too many files selected for download. Select ${MAX_ZIP_DOWNLOAD_FILES} or fewer files.`
     )
   }
+  /** An archive is opaque to redaction, so each file enters it only when its gate admits it. */
+  let filesToZip = await admitWorkspaceFiles(
+    principal,
+    context.workspaceId,
+    selectedFiles,
+    'opaque'
+  )
 
   const declaredBytes = filesToZip.reduce((sum, file) => sum + file.size, 0)
   if (declaredBytes > MAX_ZIP_DOWNLOAD_BYTES) {
@@ -189,9 +201,15 @@ async function executeDownloadWorkspaceFileItems({
     const remaining = Math.max(0, MAX_ZIP_DOWNLOAD_BYTES - reservedForStreamed - renderedBytes)
     const allowance = Math.min(remaining, MAX_RENDERED_DOCUMENT_BYTES)
     try {
-      const { buffer } = await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
-        maxBytes: allowance,
-      })
+      const { buffer, contributingFiles } = await fetchAuthorizedServableWorkspaceFileBuffer(
+        file,
+        principal,
+        { maxBytes: allowance }
+      )
+      if (!(await admitContributors(principal, context.workspaceId, contributingFiles, 'opaque'))) {
+        filesToZip = filesToZip.filter((admitted) => admitted.id !== file.id)
+        continue
+      }
       renderedBytes += buffer.length
       renderedDocuments.set(file.id, buffer)
     } catch (error) {
@@ -210,6 +228,9 @@ async function executeDownloadWorkspaceFileItems({
   if (pendingNames.length > 0) {
     throw new OrchestrationError('conflict', docNotReadyMessage(pendingNames))
   }
+  if (filesToZip.length === 0) {
+    throw new ContentRefusedError('workspace-file')
+  }
 
   return { filesToZip, folderPaths, renderedDocuments, declaredBytes }
 }
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
index 00f1b45f8d2..4dc30b0e7d2 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
@@ -1,5 +1,8 @@
 import { Readable } from 'node:stream'
-import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import {
+  createDelegatedPrincipal,
+  createSessionPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import { storageServiceMock, storageServiceMockFns } from '@sim/testing/mocks/storage-service.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
@@ -12,7 +15,13 @@ import {
   workspaceFileSecretProvenanceMockFns,
 } from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 
 class FakeDocNotReadyError extends Error {}
 
@@ -42,6 +51,8 @@ import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/d
 
 const mocks = {
   provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+  byIdentity:
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity,
   downloadStream: storageServiceMockFns.mockDownloadFileStream,
   getFile: workspaceFileManagerMockFns.mockGetWorkspaceFile,
   loadContext: workspaceFileManagerMockFns.mockLoadActiveWorkspaceFileContext,
@@ -100,6 +111,7 @@ const uploadedPdf = {
 }
 
 const SESSION = createSessionPrincipal()
+const CHAT = createDelegatedPrincipal({ audience: WORKSPACE_FILES_DELEGATION_AUDIENCE })
 
 async function readAll(stream: ReadableStream<Uint8Array>): Promise<string> {
   return new Response(stream).text()
@@ -121,24 +133,72 @@ describe('workspace file downloads', () => {
     })
   })
 
-  it('observes canonical private provenance before returning while keeping public results unchanged', async () => {
+  it('classifies a Chat download by its canonical provenance before opening storage', async () => {
     const provenance = { status: 'exact', entries: [] }
     mocks.provenance.mockResolvedValue(provenance)
-    const observe = vi.fn(async () => {})
-    const result = await observeWorkspaceFileDelivery(observe, () => downloadStream('file-2'))
-    expect(observe).toHaveBeenCalledWith(provenance, file.id)
-    expect(result.secretProvenance).toBeUndefined()
+    mocks.getFile.mockResolvedValue(plainFile)
+    const admit = vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => true))
+    const result = await observeContentDelivery({ admit }, () =>
+      downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+    )
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'workspace-file', id: plainFile.id, provenance, view: 'complete' },
+    ])
+    expect(admit.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.downloadStream.mock.invocationCallOrder[0]
+    )
+    expect(result.contentType).toBe('text/csv')
   })
-  it('does not return content if the private delivery observer refuses', async () => {
+
+  it('refuses a Chat download its gate refuses with a 403, before opening storage', async () => {
     mocks.provenance.mockResolvedValue({ status: 'unknown' })
+    mocks.getFile.mockResolvedValue(plainFile)
     await expect(
-      observeWorkspaceFileDelivery(
-        async () => {
-          throw new Error('no evidence')
+      observeContentDelivery({ admit: async (sources) => sources.map(() => false) }, () =>
+        downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+      )
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.downloadStream).not.toHaveBeenCalled()
+  })
+
+  it('refuses a Chat download no gate observes', async () => {
+    mocks.getFile.mockResolvedValue(plainFile)
+    await expect(
+      downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+    ).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+    expect(mocks.provenance).not.toHaveBeenCalled()
+    expect(mocks.downloadStream).not.toHaveBeenCalled()
+  })
+
+  it('refuses a rendered document for Chat when a file it embeds is refused', async () => {
+    const embedded = {
+      fileId: 'file-embedded',
+      key: 'workspace/workspace-1/logo.png',
+      context: 'workspace' as const,
+    }
+    mocks.getFile.mockResolvedValue(generatedDoc)
+    mocks.provenance.mockResolvedValue({ status: 'exact', entries: [] })
+    mocks.fetchServable.mockResolvedValue({
+      buffer: Buffer.from('%PDF-compiled'),
+      contentType: 'application/pdf',
+      contributingFiles: [embedded],
+    })
+    mocks.byIdentity.mockResolvedValue(new Map([[embedded.fileId, { status: 'unknown' }]]))
+    await expect(
+      observeContentDelivery(
+        {
+          admit: async (sources) => sources.map((source) => source.provenance.status !== 'unknown'),
         },
-        () => downloadStream('file-2')
+        () => downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: 'file-3' } })
       )
-    ).rejects.toThrow('no evidence')
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('reads no provenance for a session download, which no gate classifies', async () => {
+    mocks.getFile.mockResolvedValue(plainFile)
+    const result = await downloadStream(plainFile.id)
+    expect(await readAll(result.stream)).toBe('pdf')
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 
   /** Resolving an artifact costs a full buffer, so it is reserved for generation sources. */
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file.ts b/apps/sim/lib/workspace-files/application/download-workspace-file.ts
index d787ea0164d..279b013eb47 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file.ts
@@ -7,18 +7,13 @@ import {
   type ActiveWorkspaceFileContext,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { MAX_RENDERED_DOCUMENT_BYTES, needsRenderedArtifact } from '@/lib/uploads/utils/file-utils'
-import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
+import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -26,8 +21,6 @@ import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/applica
 export interface DownloadWorkspaceFileInput {
   fileId: string
   assertedWorkspaceId?: string
-  /** Trusted runtime callers can request the classification bound to the streamed bytes. */
-  includeSecretProvenance?: boolean
 }
 
 export interface DownloadWorkspaceFileResult {
@@ -43,7 +36,6 @@ export interface DownloadWorkspaceFileStreamResult extends DownloadWorkspaceFile
    */
   contentLength: number
   contentType: string
-  secretProvenance?: WorkspaceFileSecretProvenance
 }
 
 /** Audits the bytes actually handed out, which for a generated doc is not `file.size`. */
@@ -64,6 +56,7 @@ function projectDownloadAudit(file: DownloadWorkspaceFileResult['file'], servedB
 
 async function executeDownloadWorkspaceFile({
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.download,
   DownloadWorkspaceFileInput,
@@ -73,6 +66,8 @@ async function executeDownloadWorkspaceFile({
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
+  /** The record locates bytes its caller downloads without further redaction. */
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
   return { file }
 }
 
@@ -93,7 +88,6 @@ function resolveRenderedArtifact(
 }
 
 async function executeDownloadWorkspaceFileStream({
-  input,
   context,
   principal,
 }: AuthorizedWorkspaceUseCaseContext<
@@ -101,26 +95,12 @@ async function executeDownloadWorkspaceFileStream({
   DownloadWorkspaceFileInput,
   ActiveWorkspaceFileContext
 >): Promise<DownloadWorkspaceFileStreamResult> {
-  requireCopilotWorkspaceFileDeliveryObserver(principal)
   const file = await getWorkspaceFile(context.workspaceId, context.fileId, {
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
-  const secretProvenance =
-    input.includeSecretProvenance || hasWorkspaceFileDeliveryObserver()
-      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-        })
-      : undefined
-  await reportWorkspaceFileDelivery(secretProvenance, file.id)
-  return streamWorkspaceFileRecord(
-    file,
-    principal,
-    input.includeSecretProvenance ? secretProvenance : undefined
-  )
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
+  return streamWorkspaceFileRecord(file, principal)
 }
 
 /**
@@ -129,8 +109,7 @@ async function executeDownloadWorkspaceFileStream({
  */
 export async function streamWorkspaceFileRecord(
   file: DownloadWorkspaceFileResult['file'],
-  principal: Principal,
-  secretProvenance?: WorkspaceFileSecretProvenance
+  principal: Principal
 ): Promise<DownloadWorkspaceFileStreamResult> {
   /**
    * AI-generated docs store their generation SOURCE as the primary file and keep
@@ -142,7 +121,11 @@ export async function streamWorkspaceFileRecord(
    * double peak memory.
    */
   if (needsRenderedArtifact(file.type, file.name)) {
-    const { buffer, contentType } = await resolveRenderedArtifact(file, principal)
+    const { buffer, contentType, contributingFiles } = await resolveRenderedArtifact(
+      file,
+      principal
+    )
+    await requireAdmittedContributors(principal, file.workspaceId, contributingFiles, 'complete')
     return {
       file,
       stream: new ReadableStream<Uint8Array>({
@@ -155,7 +138,6 @@ export async function streamWorkspaceFileRecord(
       }),
       contentLength: buffer.length,
       contentType,
-      ...(secretProvenance ? { secretProvenance } : {}),
     }
   }
 
@@ -168,7 +150,6 @@ export async function streamWorkspaceFileRecord(
     stream: nodeReadableToWebStream(stream),
     contentLength: file.size,
     contentType: file.type || 'application/octet-stream',
-    ...(secretProvenance ? { secretProvenance } : {}),
   }
 }
 
diff --git a/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
index 95a78802487..00ed639b85c 100644
--- a/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
@@ -16,6 +16,7 @@ import {
   type VersionedWorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { parseWorkspaceFileRevision } from '@/lib/workspace-files/application/file-revision'
 import { resolveWorkspaceFileVersionWrite } from '@/lib/workspace-files/application/file-version-write'
@@ -116,6 +117,11 @@ export const editWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
        * that is merely too big. The post-edit check below covers the other
        * direction, where an edit grows a file past the same ceiling.
        */
+      /**
+       * An edit's answers — not found, ambiguous, how many matches — are read off the stored text,
+       * so it is admitted as text before a byte is read.
+       */
+      await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
       let buffer: Buffer
       try {
         buffer = await fetchWorkspaceFileBuffer(file, {
diff --git a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
index 482409d2376..e088ce40cae 100644
--- a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
+++ b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { PASTE_LIMITS, utf8ByteLength } from '@sim/utils/paste'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { asOrchestrationError, OrchestrationError } from '@/lib/core/orchestration/types'
 import { MATERIALIZE_CONCURRENCY, mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
@@ -45,6 +46,8 @@ export const exportWorkspaceFileSnapshot = defineAuthorizedWorkspaceFileUseCase(
       throw new OrchestrationError('validation', 'Markdown snapshot is too large')
     }
 
+    /** The snapshot text is the caller's own; each embedded asset is admitted by its record read. */
+    await admitContent(principal, [])
     const { ids } = extractEmbeddedFileRefs(input.content)
     const targets = await mapWithConcurrency(ids, MATERIALIZE_CONCURRENCY, async (imageId) => {
       try {
diff --git a/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts b/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
index 725740ed411..fb1eca6f949 100644
--- a/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
+++ b/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
@@ -2,19 +2,23 @@ import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { generateRequestId } from '@/lib/core/utils/request'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
-import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import {
+  downloadServableFileFromStorage,
+  type ServableFile,
+} from '@/lib/uploads/utils/file-utils.server'
 
 const logger = createLogger('FetchServableWorkspaceFileBuffer')
 
 /**
  * Resolves the rendered bytes of an already-authorized workspace file while preserving the
- * Principal for any referenced-file reads performed by the document compiler.
+ * Principal for any referenced-file reads performed by the document compiler. The result names
+ * every other file the render embedded, whose content those bytes now carry.
  */
 export async function fetchAuthorizedServableWorkspaceFileBuffer(
   fileRecord: WorkspaceFileRecord,
   filePrincipal: Principal,
   options: { maxBytes: number; signal?: AbortSignal; requestId?: string }
-): Promise<{ buffer: Buffer; contentType: string }> {
+): Promise<ServableFile> {
   return downloadServableFileFromStorage(
     {
       id: fileRecord.id,
diff --git a/apps/sim/lib/workspace-files/application/file-delivery-observer.ts b/apps/sim/lib/workspace-files/application/file-delivery-observer.ts
deleted file mode 100644
index aae029b5e71..00000000000
--- a/apps/sim/lib/workspace-files/application/file-delivery-observer.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-import type { Principal } from '@sim/auth/principal'
-import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-
-/** `fileId` names the canonical file the classification belongs to, for attribution only. */
-type WorkspaceFileDeliveryObserver = (
-  provenance: WorkspaceFileSecretProvenance | undefined,
-  fileId: string
-) => Promise<void>
-
-const observer = new AsyncLocalStorage<WorkspaceFileDeliveryObserver>()
-/** Internal transport evidence observes authorized bytes without changing public API admission or output. */
-export function observeWorkspaceFileDelivery<T>(
-  observe: WorkspaceFileDeliveryObserver,
-  execute: () => T
-): T {
-  return observer.run(observe, execute)
-}
-export function hasWorkspaceFileDeliveryObserver(): boolean {
-  return observer.getStore() !== undefined
-}
-/**
- * Runs before the canonical use case returns bytes to its transport. An observer that refuses the
- * file throws, so its bytes are never read.
- */
-export async function reportWorkspaceFileDelivery(
-  provenance: WorkspaceFileSecretProvenance | undefined,
-  fileId: string
-): Promise<void> {
-  await observer.getStore()?.(provenance, fileId)
-}
-
-/** A Chat read reached stored bytes with no observer to record their secret provenance. */
-export class WorkspaceFileDeliveryUnobservedError extends Error {
-  constructor() {
-    super('File read provenance is unavailable. Retry the read.')
-    this.name = 'WorkspaceFileDeliveryUnobservedError'
-  }
-}
-
-/**
- * Refuses a Chat caller before any bytes load unless a delivery observer is installed, so a secret
- * in the content cannot reach a model without its provenance being recorded, whatever transport
- * composed the call. Keyed on the Copilot service, not on delegation: a workflow run is delegated
- * too, but its reads feed blocks rather than Chat's model, and nothing observes them.
- */
-export function requireCopilotWorkspaceFileDeliveryObserver(principal: Principal): void {
-  if (
-    principal.kind === 'delegated' &&
-    principal.serviceId === 'copilot' &&
-    !hasWorkspaceFileDeliveryObserver()
-  ) {
-    throw new WorkspaceFileDeliveryUnobservedError()
-  }
-}
diff --git a/apps/sim/lib/workspace-files/application/file-versions.ts b/apps/sim/lib/workspace-files/application/file-versions.ts
index 3c7825eb58c..3313c7d5ef1 100644
--- a/apps/sim/lib/workspace-files/application/file-versions.ts
+++ b/apps/sim/lib/workspace-files/application/file-versions.ts
@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import type { CursorKey, ListSortOrder } from '@/lib/api/list-query'
+import { mustClassifyContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { notifyWorkspaceFilesChanged } from '@/lib/realtime/notify'
 import { getServePathPrefix } from '@/lib/uploads'
@@ -29,16 +30,12 @@ import {
 import { hasObjectNotFoundCause } from '@/lib/uploads/core/errors'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 import { formatFileSize } from '@/lib/uploads/utils/file-utils'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
   type DownloadWorkspaceFileStreamResult,
   streamWorkspaceFileRecord,
 } from '@/lib/workspace-files/application/download-workspace-file'
-import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
 import { parseWorkspaceFileRevision } from '@/lib/workspace-files/application/file-revision'
 import { resolveWorkspaceFileVersionWrite } from '@/lib/workspace-files/application/file-version-write'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -125,10 +122,11 @@ async function loadVersion(
 }
 
 async function readVersionSecretProvenance(
+  principal: Principal,
   file: WorkspaceFileRecord,
   version: WorkspaceFileVersionRecord
 ): Promise<WorkspaceFileSecretProvenance | undefined> {
-  if (!hasWorkspaceFileDeliveryObserver()) return undefined
+  if (!mustClassifyContent(principal)) return undefined
   if (version.isCurrent) {
     return getBoundWorkspaceFileSecretProvenance(file.workspaceId, {
       fileId: file.id,
@@ -220,11 +218,10 @@ export const readWorkspaceFileVersionText = defineAuthorizedWorkspaceFileUseCase
     principal,
     request,
   }): Promise<ReadWorkspaceFileVersionTextResult> {
-    requireCopilotWorkspaceFileDeliveryObserver(principal)
     const file = await loadActiveFile(context)
     const version = await loadVersion(file, input.version)
     const fileAtVersion = recordAtVersion(file, version)
-    const secretProvenance = await readVersionSecretProvenance(file, version)
+    const secretProvenance = await readVersionSecretProvenance(principal, file, version)
     const result = await readVersionObject(version.version, () =>
       extractWorkspaceFileRecordText(
         fileAtVersion,
@@ -245,7 +242,13 @@ export const downloadWorkspaceFileVersion = defineAuthorizedWorkspaceFileUseCase
   async execute({ input, context, principal }): Promise<DownloadWorkspaceFileVersionResult> {
     const file = await loadActiveFile(context)
     const version = await loadVersion(file, input.version)
-    await reportWorkspaceFileDelivery(await readVersionSecretProvenance(file, version), file.id)
+    await requireAdmittedWorkspaceFile(
+      principal,
+      file.workspaceId,
+      file,
+      'complete',
+      await readVersionSecretProvenance(principal, file, version)
+    )
     const result = await readVersionObject(version.version, () =>
       streamWorkspaceFileRecord(recordAtVersion(file, version), principal)
     )
diff --git a/apps/sim/lib/workspace-files/application/operations.ts b/apps/sim/lib/workspace-files/application/operations.ts
index e0d7417886b..c96ff002871 100644
--- a/apps/sim/lib/workspace-files/application/operations.ts
+++ b/apps/sim/lib/workspace-files/application/operations.ts
@@ -26,7 +26,7 @@ const HUMAN_FILE_TOOL_PRINCIPAL_POLICY = {
 } as const
 /**
  * Chat may list, read and revert versions as the delegating user: a version text read refuses a
- * delegated caller unless a delivery observer records the snapshot's secret provenance, and a
+ * delegated caller unless the surface's content gate admits the snapshot's secret provenance, and a
  * revert writes a new, undoable version that reinstates that provenance. Deleting a version purges
  * history irreversibly, so it admits direct callers only. Download stays direct-only too, but it
  * is not a hard boundary for a writer: reverting to a version and downloading the current file
@@ -45,6 +45,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   readMetadata: defineWorkspaceOperation({
@@ -53,6 +54,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   readContent: defineWorkspaceOperation({
@@ -61,6 +63,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   searchContent: defineWorkspaceOperation({
@@ -69,6 +72,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   download: defineWorkspaceOperation({
@@ -77,6 +81,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   compiledCheck: defineWorkspaceOperation({
@@ -92,6 +97,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   rename: defineWorkspaceOperation({
@@ -100,6 +106,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   /**
@@ -120,6 +127,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   updateContent: defineWorkspaceOperation({
@@ -128,6 +136,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateMetadata: defineWorkspaceOperation({
@@ -136,6 +145,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   move: defineWorkspaceOperation({
@@ -144,6 +154,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -152,6 +163,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   restore: defineWorkspaceOperation({
@@ -160,6 +172,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   listVersions: defineWorkspaceOperation({
@@ -168,6 +181,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   readVersion: defineWorkspaceOperation({
@@ -176,6 +190,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   readVersionContent: defineWorkspaceOperation({
@@ -184,6 +199,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   downloadVersion: defineWorkspaceOperation({
@@ -200,6 +216,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   deleteVersion: defineWorkspaceOperation({
@@ -216,6 +233,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateShare: defineWorkspaceOperation({
@@ -224,6 +242,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...HUMAN_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   listFolders: defineWorkspaceOperation({
@@ -232,6 +251,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   createFolder: defineWorkspaceOperation({
@@ -240,6 +260,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateFolder: defineWorkspaceOperation({
@@ -248,6 +269,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   deleteFolder: defineWorkspaceOperation({
@@ -256,6 +278,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   restoreFolder: defineWorkspaceOperation({
@@ -264,6 +287,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   uploadCreate: defineWorkspaceOperation({
@@ -272,6 +296,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   /**
@@ -294,6 +319,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   uploadComplete: defineWorkspaceOperation({
@@ -302,6 +328,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   uploadCancel: defineWorkspaceOperation({
@@ -310,6 +337,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts b/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
index acdb813194e..a28e3966c26 100644
--- a/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
+++ b/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
@@ -7,6 +7,7 @@ import {
 import { type FileMetadataRecord, getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import { isWorkspaceScopedContext } from '@/lib/uploads/shared/types'
 import { tryInferContextFromKey } from '@/lib/uploads/utils/file-utils'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { workspaceFileDelegationPolicy } from '@/lib/workspace-files/application/authorization'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
@@ -70,7 +71,7 @@ export const readStoredWorkspaceFileRecordByKey = defineAuthorizedWorkspaceUseCa
           principal.resourceScope.chatId === context.file.chatId),
     },
   },
-  async execute({ input, context }): Promise<{ file: FileMetadataRecord }> {
+  async execute({ input, context, principal }): Promise<{ file: FileMetadataRecord }> {
     const file = await getFileMetadataByKey(input.key)
     if (
       !file ||
@@ -84,6 +85,18 @@ export const readStoredWorkspaceFileRecordByKey = defineAuthorizedWorkspaceUseCa
     ) {
       throw new StoredWorkspaceFileUnavailableError()
     }
+    /** Callers read and hand on this key's raw bytes, which no redaction reaches. */
+    await requireAdmittedWorkspaceFile(
+      principal,
+      context.workspaceId,
+      {
+        id: file.id,
+        key: file.key,
+        storageContext: context.file.context === 'mothership' ? 'mothership' : 'workspace',
+        contentUpdatedAt: file.contentUpdatedAt,
+      },
+      'opaque'
+    )
     return { file }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
index 833c62aa781..27494b0523c 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
@@ -27,14 +27,42 @@ vi.mock('@/lib/workspace-files/application/resolve-rendered-workspace-artifact',
   resolveRenderedWorkspaceArtifact: hoisted.render,
 }))
 
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { readWorkspaceFileArtifact } from '@/lib/workspace-files/application/read-workspace-file-artifact'
 
 const mocks = {
   permission: workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission,
   context: workspaceFileReferenceMockFns.mockResolveReferencedWorkspaceFileContext,
   ...hoisted,
-  safe: workspaceFileSecretProvenanceMockFns.mockIsOpaqueWorkspaceFileEgressSafe,
+  provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+}
+
+/** Records each item it is asked about and admits only the ones with no recorded secret. */
+const decided: unknown[] = []
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    decided.push(...sources)
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
 }
+const chatPrincipal = createCopilotChatFilePrincipal({
+  userId: 'u',
+  workspaceId: 'ws',
+  chatId: 'chat',
+})
+const readAsChat = () =>
+  observeContentDelivery(secretFreeGate, () =>
+    readWorkspaceFileArtifact.execute({ principal: chatPrincipal, input })
+  )
 
 const principal: Principal = createSessionPrincipal({ userId: 'u', sessionId: 's' })
 const input = { workspaceId: 'ws', reference: 'files/report.pdf', maxBytes: 1024 }
@@ -48,8 +76,9 @@ const file = {
 
 describe('authorized artifact observations', () => {
   beforeEach(() => {
+    decided.length = 0
     mocks.permission.mockResolvedValue('read')
-    mocks.safe.mockResolvedValue(true)
+    mocks.provenance.mockResolvedValue({ status: 'exact', entries: [] })
     mocks.context.mockResolvedValue({
       workspaceId: 'ws',
       fileId: 'file',
@@ -68,14 +97,37 @@ describe('authorized artifact observations', () => {
     mocks.permission.mockResolvedValue(null)
     await expect(readWorkspaceFileArtifact.execute({ principal, input })).rejects.toThrow()
     expect(mocks.render).not.toHaveBeenCalled()
-    expect(mocks.safe).not.toHaveBeenCalled()
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 
-  it('refuses model-unsafe bytes before reading or compiling, even when the actor can read the file', async () => {
-    mocks.safe.mockResolvedValue(false)
-    await expect(readWorkspaceFileArtifact.execute({ principal, input })).rejects.toThrow(
-      'File cannot be sent to a model'
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'u' }] },
+  ])(
+    'refuses Chat model-unsafe bytes before reading or compiling, even when the actor can read the file: %j',
+    async (provenance) => {
+      mocks.provenance.mockResolvedValue(provenance)
+      await expect(readAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mocks.render).not.toHaveBeenCalled()
+    }
+  )
+
+  it('classifies the file as an opaque view bound to the bytes it renders', async () => {
+    expect((await readAsChat()).buffer).toEqual(Buffer.from('%PDF-1.7'))
+    expect(mocks.provenance).toHaveBeenCalledWith('ws', {
+      fileId: 'file',
+      key: 'canonical-key',
+      context: 'workspace',
+      contentUpdatedAt: file.contentUpdatedAt,
+    })
+    expect(decided).toEqual([expect.objectContaining({ id: 'file', view: 'opaque' })])
+  })
+
+  it('renders for a caller outside Chat without classifying', async () => {
+    mocks.provenance.mockResolvedValue({ status: 'unknown' })
+    expect((await readWorkspaceFileArtifact.execute({ principal, input })).buffer).toEqual(
+      Buffer.from('%PDF-1.7')
     )
-    expect(mocks.render).not.toHaveBeenCalled()
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
index ef4c968141b..3ac1df906bb 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
@@ -1,9 +1,8 @@
 import type { Principal } from '@sim/auth/principal'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
-  isOpaqueWorkspaceFileEgressSafe,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
@@ -31,17 +30,17 @@ export const readWorkspaceFileArtifact = defineAuthorizedWorkspaceFileUseCase({
       includeOwnedFiles: true,
     }),
   async execute({ input, context, principal }) {
-    const file = context.file
-    const safe = await isOpaqueWorkspaceFileEgressSafe(context.workspaceId, {
-      fileId: file.id,
-      key: file.key,
-      context: file.storageContext ?? 'workspace',
-      ...(file.contentUpdatedAt ? { contentUpdatedAt: file.contentUpdatedAt } : {}),
-    })
-    if (!safe) throw new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, context.file, 'opaque')
     const artifact = await resolveRenderedWorkspaceArtifact(context.file, principal, {
       maxBytes: input.maxBytes,
     })
-    return { file: context.file, ...artifact }
+    /** An image of a document shows every file it embedded, none of which redaction can reach. */
+    await requireAdmittedContributors(
+      principal,
+      context.workspaceId,
+      artifact.contributingFiles,
+      'opaque'
+    )
+    return { file: context.file, buffer: artifact.buffer, contentType: artifact.contentType }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
index 0735d4db460..186a684b023 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
@@ -10,6 +10,7 @@ import {
 } from '@/lib/uploads/contexts/workspace'
 import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { assertOwnedFileAccess } from '@/lib/workspace-files/application/workspace-file-context'
@@ -44,12 +45,14 @@ async function loadCurrentWorkspaceFileByKey(
 async function executeReadWorkspaceFileContentByKey({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceFileByKeyInput,
   ActiveWorkspaceFileContext
 >): Promise<ReadWorkspaceFileContentByKeyResult> {
   const file = await loadCurrentWorkspaceFileByKey(input, context)
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
   return {
     file,
     content: await fetchWorkspaceFileBuffer(file, { maxBytes: MAX_BUFFERED_TRANSFER_BYTES }),
@@ -88,8 +91,11 @@ async function resolveWorkspaceFileByKeyContext({
 export const readWorkspaceFileRecordByKey = defineAuthorizedWorkspaceFileUseCase({
   operation: fileOperations.readContent,
   resolveContext: resolveWorkspaceFileByKeyContext,
-  async execute({ input, context }): Promise<ReadWorkspaceFileRecordByKeyResult> {
-    return { file: await loadCurrentWorkspaceFileByKey(input, context) }
+  async execute({ input, context, principal }): Promise<ReadWorkspaceFileRecordByKeyResult> {
+    const file = await loadCurrentWorkspaceFileByKey(input, context)
+    /** Callers serve this key's raw bytes, which no redaction reaches. */
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
+    return { file }
   },
 })
 
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 7298506e054..1225ba0b6f6 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -11,6 +11,7 @@ import {
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -34,6 +35,7 @@ export interface ReadWorkspaceFileContentResult {
 async function executeReadWorkspaceFileContent({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceFileContentInput,
@@ -46,6 +48,7 @@ async function executeReadWorkspaceFileContent({
     includeOwnedFiles: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
   const content = await fetchWorkspaceFileBuffer(file, {
     maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
   })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
index f36cf5bb52f..2bb7530e78d 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
@@ -1,4 +1,3 @@
-import { createLogger } from '@sim/logger'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
@@ -11,18 +10,16 @@ import {
   fetchWorkspaceFileBuffer,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { isGeneratedDocumentSourceType } from '@/lib/uploads/utils/file-utils'
+import {
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
 
-const logger = createLogger('WorkspaceFileMount')
-
 export interface ReadWorkspaceFileMountInput {
   fileId: string
   assertedWorkspaceId: string
@@ -34,7 +31,6 @@ export interface ReadWorkspaceFileMountInput {
 export interface ReadWorkspaceFileMountResult {
   mount: SandboxFile
   budget: SandboxMountBudget
-  secretProvenance: WorkspaceFileSecretProvenance
 }
 
 /** Prepares one private runtime mount from one authorized canonical file version. */
@@ -52,6 +48,12 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
     })
     if (!file) throw new OrchestrationError('not_found', 'File not found')
     input.signal?.throwIfAborted()
+    /**
+     * Classified before any byte is read, bound to the storage key the mount reads: a key is never
+     * rewritten in place, so the bytes mounted below are the bytes this classification describes.
+     */
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
+    input.signal?.throwIfAborted()
     const mounts: SandboxFile[] = []
     const budget = { ...input.budget }
     const rendersFromSource = isGeneratedDocumentSourceType(file.type)
@@ -65,19 +67,27 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
         rendersFromSource,
         readInline: async (maxBytes) => {
           input.signal?.throwIfAborted()
-          const buffer = rendersFromSource
-            ? (
-                await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
-                  maxBytes,
-                  signal: input.signal,
-                }).catch((error) => {
-                  if (!isPayloadSizeLimitError(error)) throw error
-                  throw new Error(
-                    `Input file "${input.mountPath}" renders to more than the ${MAX_INLINE_MOUNT_FILE_BYTES / 1024 / 1024}MB per-file mount limit, or than the mount budget left. Mount fewer or smaller files.`
-                  )
-                })
-              ).buffer
-            : await fetchWorkspaceFileBuffer(file, { maxBytes })
+          let buffer: Buffer
+          if (rendersFromSource) {
+            const rendered = await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
+              maxBytes,
+              signal: input.signal,
+            }).catch((error) => {
+              if (!isPayloadSizeLimitError(error)) throw error
+              throw new Error(
+                `Input file "${input.mountPath}" renders to more than the ${MAX_INLINE_MOUNT_FILE_BYTES / 1024 / 1024}MB per-file mount limit, or than the mount budget left. Mount fewer or smaller files.`
+              )
+            })
+            await requireAdmittedContributors(
+              principal,
+              context.workspaceId,
+              rendered.contributingFiles,
+              'complete'
+            )
+            buffer = rendered.buffer
+          } else {
+            buffer = await fetchWorkspaceFileBuffer(file, { maxBytes })
+          }
           input.signal?.throwIfAborted()
           return {
             content: buffer.toString('base64'),
@@ -89,21 +99,8 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
       budget
     )
     input.signal?.throwIfAborted()
-    /** A changed or absent revision cannot certify the bytes already selected above. */
-    const secretProvenance: WorkspaceFileSecretProvenance = file.contentUpdatedAt
-      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt,
-        }).catch((error) => {
-          logger.warn('Mount classification unavailable', { fileId: file.id, error })
-          return { status: 'unknown' } as const
-        })
-      : { status: 'unknown' }
-    input.signal?.throwIfAborted()
     const mount = mounts[0]
     if (!mount) throw new Error('File mount preparation returned no bytes or URL')
-    return { mount, budget, secretProvenance }
+    return { mount, budget }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
index cbd9d1965e0..f665a83c68b 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
@@ -6,6 +6,7 @@ import {
   getWorkspaceFile,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -20,9 +21,8 @@ export interface ReadWorkspaceFileRecordResult {
 }
 
 /**
- * Record reads by id admit chat uploads: the sandbox mount reloads an `uploads/<name>`
- * upload through here before presigning it. Listings never surface chat uploads and
- * writes never resolve them.
+ * Record reads by id admit chat uploads. Listings never surface chat uploads and writes never
+ * resolve them.
  */
 function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(operation: O) {
   return defineAuthorizedWorkspaceFileUseCase({
@@ -41,6 +41,7 @@ function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(opera
       }),
     async execute({
       context,
+      principal,
     }: AuthorizedWorkspaceUseCaseContext<
       O,
       ReadWorkspaceFileRecordInput,
@@ -52,6 +53,8 @@ function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(opera
         includeOwnedFiles: true,
       })
       if (!file) throw new OrchestrationError('not_found', 'File not found')
+      /** Callers read and hand on the record's raw bytes, which no redaction reaches. */
+      await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
       return { file }
     },
   })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
index 3d6103307c0..04074cae8ae 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
@@ -1,4 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
@@ -25,7 +26,7 @@ export const readWorkspaceFileSecretProvenance = defineAuthorizedWorkspaceFileUs
     principal: Principal
     input: ReadWorkspaceFileSecretProvenanceInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  async execute({ input, context }): Promise<{
+  async execute({ input, context, principal }): Promise<{
     provenance: WorkspaceFileSecretProvenance
     ownerUserId: string
   }> {
@@ -34,6 +35,8 @@ export const readWorkspaceFileSecretProvenance = defineAuthorizedWorkspaceFileUs
       includeOwnedFiles: true,
     })
     if (!file) throw new OrchestrationError('not_found', 'File not found')
+    /** A classification names secrets by ciphertext only and returns none of the file's content. */
+    await admitContent(principal, [])
     return {
       provenance: await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
         fileId: file.id,
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
index 1fa9e922d85..be83e9c2592 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import {
+  createDelegatedPrincipal,
   createPersonalApiKeyPrincipal,
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
@@ -19,8 +20,13 @@ import {
   workspaceUploadsMockFns,
 } from '@sim/testing/mocks/workspace-uploads.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { FileParserError } from '@/lib/file-parsers/errors'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 
 const hoisted = vi.hoisted(() => ({
   fetchServable: vi.fn(),
@@ -41,7 +47,10 @@ vi.mock('@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 
 vi.mock('@/lib/file-parsers', () => fileParsersMock)
 
-import { readWorkspaceFileText } from '@/lib/workspace-files/application/read-workspace-file-text'
+import {
+  extractWorkspaceFileRecordText,
+  readWorkspaceFileText,
+} from '@/lib/workspace-files/application/read-workspace-file-text'
 
 const mocks = {
   provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
@@ -82,6 +91,13 @@ function fileRecord(overrides: Record<string, unknown> = {}) {
   }
 }
 
+/** A record as the use case hands it to extraction, with the full shape provenance binds to. */
+function fileRecordForChat() {
+  return fileRecord({ contentUpdatedAt: new Date('2026-01-01T00:00:00.000Z') }) as Parameters<
+    typeof extractWorkspaceFileRecordText
+  >[0]
+}
+
 /** The canonical context the reference resolver hands back, carrying the record it resolved. */
 function referenceContext(overrides: Record<string, unknown> = {}) {
   return { ...fileContext, file: fileRecord(overrides) }
@@ -103,28 +119,49 @@ describe('readWorkspaceFileText', () => {
     mocks.parseBuffer.mockResolvedValue({ content: 'hello there!', metadata: {} })
   })
 
-  it('observes canonical private provenance before returning while keeping public results unchanged', async () => {
+  it('classifies a Chat read by its canonical provenance before reading any bytes', async () => {
     const provenance = { status: 'exact', entries: [] }
     mocks.provenance.mockResolvedValue(provenance)
-    const observe = vi.fn(async () => {})
-    const result = await observeWorkspaceFileDelivery(observe, () =>
-      readWorkspaceFileText.execute({ principal: principals[0], input: input() })
+    const admit = vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => true))
+    const result = await observeContentDelivery({ admit }, () =>
+      extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
+    )
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'workspace-file', id: FILE_ID, provenance, view: 'complete' },
+    ])
+    expect(admit.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.fetchBuffer.mock.invocationCallOrder[0]
     )
-    expect(observe).toHaveBeenCalledWith(provenance, FILE_ID)
-    expect(result.secretProvenance).toBeUndefined()
+    expect(result.text).toBe('hello there!')
   })
-  it('does not return content if the private delivery observer refuses', async () => {
+
+  it('refuses a Chat read its gate refuses with a 403, before reading any bytes', async () => {
     mocks.provenance.mockResolvedValue({ status: 'unknown' })
     await expect(
-      observeWorkspaceFileDelivery(
-        async () => {
-          throw new Error('no evidence')
-        },
-        () => readWorkspaceFileText.execute({ principal: principals[0], input: input() })
+      observeContentDelivery({ admit: async (sources) => sources.map(() => false) }, () =>
+        extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
       )
-    ).rejects.toThrow('no evidence')
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.fetchBuffer).not.toHaveBeenCalled()
   })
 
+  it('refuses a Chat read no gate observes, before reading provenance or bytes', async () => {
+    await expect(
+      extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
+    ).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+    expect(mocks.provenance).not.toHaveBeenCalled()
+    expect(mocks.fetchBuffer).not.toHaveBeenCalled()
+  })
+
+  it.each(principals)(
+    'reads no provenance for a $kind caller, which no gate classifies',
+    async (principal) => {
+      const result = await readWorkspaceFileText.execute({ principal, input: input() })
+      expect(result.text).toBe('hello there!')
+      expect(mocks.provenance).not.toHaveBeenCalled()
+    }
+  )
+
   it('uses the complete text representation before selecting a line window', async () => {
     const controller = new AbortController()
     mocks.parseBuffer.mockResolvedValueOnce({ content: 'header\ntail needle\n', metadata: {} })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
index 82ad8f03edd..39917f92800 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
@@ -9,22 +9,18 @@ import {
   fetchWorkspaceFileBuffer,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import {
   formatFileSize,
   getFileExtension,
   MAX_TEXT_EXTRACTION_BYTES,
   needsRenderedArtifact,
 } from '@/lib/uploads/utils/file-utils'
-import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
+import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
 import {
@@ -47,8 +43,6 @@ export interface ReadWorkspaceFileTextInput {
   offset?: number
   /** How many lines to return from `offset`. Absent reads to the end. */
   limit?: number
-  /** Private classification for runtime consumers, omitted from ordinary API reads. */
-  includeSecretProvenance?: boolean
   /** Internal agent reads can decode plain source files identified by their MIME type. */
   allowPlainText?: boolean
 }
@@ -74,7 +68,6 @@ export interface ReadWorkspaceFileTextResult {
     /** False when extraction was truncated, so `totalLines` is not the file's end. */
     totalLinesExact: boolean
   }
-  secretProvenance?: WorkspaceFileSecretProvenance
 }
 
 /**
@@ -115,7 +108,6 @@ async function executeReadWorkspaceFileText({
 >): Promise<ReadWorkspaceFileTextResult> {
   const signal = request?.signal
   signal?.throwIfAborted()
-  requireCopilotWorkspaceFileDeliveryObserver(principal)
   return extractWorkspaceFileRecordText(context.file, input, principal, signal)
 }
 
@@ -125,25 +117,18 @@ async function executeReadWorkspaceFileText({
  */
 export async function extractWorkspaceFileRecordText(
   file: WorkspaceFileRecord,
-  input: Pick<
-    ReadWorkspaceFileTextInput,
-    'maxBytes' | 'offset' | 'limit' | 'allowPlainText' | 'includeSecretProvenance'
-  >,
+  input: Pick<ReadWorkspaceFileTextInput, 'maxBytes' | 'offset' | 'limit' | 'allowPlainText'>,
   principal: Principal,
   signal?: AbortSignal,
   sourceProvenance?: WorkspaceFileSecretProvenance
 ): Promise<ReadWorkspaceFileTextResult> {
-  const secretProvenance =
-    sourceProvenance ??
-    (input.includeSecretProvenance || hasWorkspaceFileDeliveryObserver()
-      ? await getBoundWorkspaceFileSecretProvenance(file.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-        })
-      : undefined)
-  await reportWorkspaceFileDelivery(secretProvenance, file.id)
+  await requireAdmittedWorkspaceFile(
+    principal,
+    file.workspaceId,
+    file,
+    'complete',
+    sourceProvenance
+  )
 
   const extension = input.allowPlainText
     ? (workspaceFileTextFormat(file) ?? getFileExtension(file.name))
@@ -165,16 +150,24 @@ export async function extractWorkspaceFileRecordText(
    * is what the name promises, so it is what gets parsed. Matches the download
    * path, which resolves the same artifact for the same reason.
    */
-  const content = needsRenderedArtifact(file.type, file.name)
-    ? (
-        await resolveRenderedWorkspaceArtifact(file, principal, {
-          maxBytes,
-          signal,
-          tooLargeMessage: (limit) =>
-            `"${file.name}" renders to more than ${limit}, above the text-extraction limit; download the raw bytes instead of extracting text`,
-        })
-      ).buffer
-    : await readSourceBuffer(file, maxBytes, signal)
+  let content: Buffer
+  if (needsRenderedArtifact(file.type, file.name)) {
+    const rendered = await resolveRenderedWorkspaceArtifact(file, principal, {
+      maxBytes,
+      signal,
+      tooLargeMessage: (limit) =>
+        `"${file.name}" renders to more than ${limit}, above the text-extraction limit; download the raw bytes instead of extracting text`,
+    })
+    await requireAdmittedContributors(
+      principal,
+      file.workspaceId,
+      rendered.contributingFiles,
+      'complete'
+    )
+    content = rendered.buffer
+  } else {
+    content = await readSourceBuffer(file, maxBytes, signal)
+  }
   const parsed = await parseFileText(content, extension, file.name, signal)
   const metadata = parsed.metadata ?? {}
 
@@ -193,7 +186,6 @@ export async function extractWorkspaceFileRecordText(
     degraded: metadata.degraded === true,
     degradedReason: metadata.degraded === true ? (metadata.warning ?? null) : null,
     byteCount: content.byteLength,
-    ...(input.includeSecretProvenance && secretProvenance ? { secretProvenance } : {}),
     ...(lineRange ? { lineRange } : {}),
   }
 }
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts b/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
index cff1cc494c9..aa25d8bbaf8 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
@@ -9,6 +9,7 @@ import {
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
@@ -37,6 +38,7 @@ export interface ReadWorkspaceInlineFileResult {
 async function executeReadWorkspaceInlineFile({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceInlineFileInput,
@@ -46,6 +48,7 @@ async function executeReadWorkspaceInlineFile({
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'Not found')
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
 
   const stream = await downloadFileStream({ key: file.key, context: 'workspace' })
   return {
diff --git a/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts b/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
index 889b8332789..30738ae67d6 100644
--- a/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
+++ b/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
@@ -4,6 +4,7 @@ import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { docNotReadyMessage, isDocNotReadyError } from '@/lib/uploads/utils/doc-not-ready'
 import { formatFileSize } from '@/lib/uploads/utils/file-utils'
+import type { ServableFile } from '@/lib/uploads/utils/file-utils.server'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 
 /**
@@ -31,7 +32,7 @@ export async function resolveRenderedWorkspaceArtifact(
   file: WorkspaceFileRecord,
   filePrincipal: Principal,
   options: { maxBytes: number; signal?: AbortSignal; tooLargeMessage?: (limit: string) => string }
-): Promise<{ buffer: Buffer; contentType: string }> {
+): Promise<ServableFile> {
   try {
     options.signal?.throwIfAborted()
     return await fetchAuthorizedServableWorkspaceFileBuffer(file, filePrincipal, {
diff --git a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
index e7c19d6811f..682c848e4b6 100644
--- a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
+++ b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { OperationUseCase, WorkspaceOperation } from '@/lib/core/application'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   type ActiveWorkspaceFileContext,
@@ -98,7 +99,9 @@ function defineWorkspaceFileReferenceUseCase<const O extends WorkspaceOperation>
       principal: Principal
       input: WorkspaceFileReferenceInput
     }) => resolveReferencedWorkspaceFileContext(principal, input, options),
-    async execute({ context }): Promise<WorkspaceFileReferenceResult> {
+    async execute({ context, principal }): Promise<WorkspaceFileReferenceResult> {
+      /** Resolution authorizes under the content operation but returns only the file's record. */
+      await admitContent(principal, [])
       return { file: context.file }
     },
   })
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index 0c6e97ef267..b9c91fa8eab 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -1,5 +1,6 @@
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { loadActiveWorkspaceContext } from '@/lib/uploads/contexts/workspace'
+import { admitWorkspaceFileIdentities } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveWorkspaceFolderScope } from '@/lib/workspace-files/resolve-folder-scope'
@@ -61,13 +62,32 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     signal?.throwIfAborted()
 
     try {
-      return await searchWorkspaceFileIndex({
+      const found = await searchWorkspaceFileIndex({
         workspaceId: context.workspaceId,
         pattern: compileFileSearchPattern(input.query, input.mode),
         maxResults: input.maxResults,
         folderScope,
         signal,
       })
+      /**
+       * A match is evaluated against a file's raw indexed text, so a hit in a file holding a
+       * recorded secret answers a question about that secret whatever its preview shows. Such a
+       * file's lines are therefore withheld like an unknown file's; grep matches redacted text.
+       */
+      const admitted = await admitWorkspaceFileIdentities(
+        principal,
+        context.workspaceId,
+        found.sources.map((source) => source.identity),
+        'opaque'
+      )
+      if (admitted.size === found.sources.length) return found
+      const results = found.results.filter((result) => admitted.has(result.fileId))
+      return {
+        ...found,
+        results,
+        count: results.length,
+        sources: found.sources.filter((source) => admitted.has(source.identity.fileId)),
+      }
     } catch (error) {
       /**
        * A rejected or too-expensive pattern is the caller's to fix, and the
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
index bed5d97e673..3133a79bbde 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
@@ -7,6 +7,10 @@ import {
   workspaceFileManagerMock,
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
@@ -17,7 +21,21 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => workspa
 
 vi.mock('@/ee/access-control/utils/permission-check', () => permissionCheckMock)
 
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+const provenance = {
+  bound: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+  current: workspaceFileSecretProvenanceMockFns.mockGetCurrentWorkspaceFileSecretProvenance,
+}
+
 import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
@@ -39,6 +57,31 @@ const mocks = {
 
 const principal = createSessionPrincipal()
 
+/** Chat's gate with no registry: a link is opaque, so only a secret-free file is admitted. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+const asChat = <T>(execute: () => T) => observeContentDelivery(secretFreeGate, execute)
+
+function copilotPrincipal() {
+  const copilot = createCopilotChatPrincipal(
+    { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
+    WORKSPACE_FILES_DELEGATION_AUDIENCE
+  )
+  markCopilotWorkspaceInvocation(copilot)
+  return copilot
+}
+
+beforeEach(() => {
+  provenance.bound.mockResolvedValue({ status: 'exact', entries: [] })
+})
+
 describe('getWorkspaceFileShares', () => {
   beforeEach(() => {
     mocks.resolvePermission.mockResolvedValue('read')
@@ -78,6 +121,30 @@ describe('getWorkspaceFileShares', () => {
 
     expect(mocks.getWorkspaceShares).not.toHaveBeenCalled()
   })
+
+  it('shows Chat only the live links to files its gate admits', async () => {
+    mocks.getWorkspaceShares.mockResolvedValue(
+      new Map([
+        ['clean', { isActive: true }],
+        ['secret', { isActive: true }],
+        ['inactive', { isActive: false }],
+      ])
+    )
+    provenance.current.mockResolvedValue(
+      new Map([
+        ['clean', { status: 'exact', entries: [] }],
+        ['secret', { status: 'unknown' }],
+      ])
+    )
+    const { shares } = await asChat(() =>
+      getWorkspaceFileShares.execute({
+        principal: copilotPrincipal(),
+        input: { workspaceId: 'workspace-1', fileIds: ['clean', 'secret', 'inactive'] },
+      })
+    )
+    expect([...shares.keys()]).toEqual(['clean', 'inactive'])
+    expect(provenance.current).toHaveBeenCalledWith('workspace-1', ['clean', 'secret'])
+  })
 })
 
 describe('updateWorkspaceFileShare password references', () => {
@@ -88,15 +155,6 @@ describe('updateWorkspaceFileShare password references', () => {
     billedAccountUserId: 'billing-owner',
   }
 
-  function copilotPrincipal() {
-    const copilot = createCopilotChatPrincipal(
-      { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
-      WORKSPACE_FILES_DELEGATION_AUDIENCE
-    )
-    markCopilotWorkspaceInvocation(copilot)
-    return copilot
-  }
-
   function share(
     caller: Parameters<typeof updateWorkspaceFileShare.execute>[0]['principal'],
     password: string,
@@ -138,7 +196,7 @@ describe('updateWorkspaceFileShare password references', () => {
   it("stores the value of the agent's referenced variable, not the placeholder", async () => {
     environment({ SHARE_PW: 'resolved-share-password' })
 
-    await share(copilotPrincipal(), '{{SHARE_PW}}')
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))
 
     expect(environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables).toHaveBeenCalledWith(
       'user-1',
@@ -151,13 +209,32 @@ describe('updateWorkspaceFileShare password references', () => {
   })
 
   it('refuses an unset variable by name', async () => {
-    await expect(share(copilotPrincipal(), '{{SHARE_PW}}')).rejects.toMatchObject({
+    await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toMatchObject({
       code: 'validation',
       message: expect.stringContaining('Environment variable "SHARE_PW"'),
     })
     expect(mocks.upsertFileShare).not.toHaveBeenCalled()
   })
 
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }] },
+  ])('refuses Chat a live link to a file its gate refuses: %j', async (refused) => {
+    provenance.bound.mockResolvedValue(refused)
+    environment({ SHARE_PW: 'resolved-share-password' })
+    await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toBeInstanceOf(
+      ContentRefusedError
+    )
+    expect(mocks.upsertFileShare).not.toHaveBeenCalled()
+  })
+
+  it('lets a person share a file whatever its provenance', async () => {
+    provenance.bound.mockResolvedValue({ status: 'unknown' })
+    await share(principal, 'a-long-literal-password-value')
+    expect(mocks.upsertFileShare).toHaveBeenCalled()
+    expect(provenance.bound).not.toHaveBeenCalled()
+  })
+
   it('keeps a reference literal for any other caller, under the same rules', async () => {
     await expect(share(principal, '{{SHORT}}')).rejects.toMatchObject({
       code: 'validation',
@@ -175,7 +252,7 @@ describe('updateWorkspaceFileShare password references', () => {
 
   it('resolves only when the effective share mode is password', async () => {
     mocks.getShare.mockResolvedValue({ authType: 'email' })
-    await share(copilotPrincipal(), '{{SHARE_PW}}', {})
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}', {}))
     expect(environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables).not.toHaveBeenCalled()
     expect(mocks.upsertFileShare).toHaveBeenCalledWith(
       expect.objectContaining({ password: '{{SHARE_PW}}' })
@@ -183,7 +260,7 @@ describe('updateWorkspaceFileShare password references', () => {
 
     mocks.getShare.mockResolvedValue({ authType: 'password' })
     environment({ SHARE_PW: 'resolved-share-password' })
-    await share(copilotPrincipal(), '{{SHARE_PW}}', {})
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}', {}))
     expect(mocks.upsertFileShare).toHaveBeenLastCalledWith(
       expect.objectContaining({ password: 'resolved-share-password' })
     )
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
index bfb2b0bf4c2..2dae3a5bb63 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
@@ -6,6 +6,11 @@ import {
   type ShareRecord,
   sharePasswordSchema,
 } from '@/lib/api/contracts/public-shares'
+import {
+  admitContent,
+  admitEach,
+  ContentRefusedError,
+} from '@/lib/core/application/content-delivery'
 import { resolveCopilotSecretReference } from '@/lib/core/application/environment-reference'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { parseExactEnvironmentReference } from '@/lib/environment/reference'
@@ -19,6 +24,8 @@ import {
   getWorkspaceFile,
   loadActiveWorkspaceContext,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { getCurrentWorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -67,12 +74,36 @@ export class WorkspaceFileShareNoopError extends Error {
   }
 }
 
+/**
+ * A live link serves a file's raw bytes to whoever opens it, so Chat may see a link only to a file
+ * whose bytes it could be handed directly; returns the ids whose links may be shown.
+ */
+async function admitSharedFiles(
+  principal: Principal,
+  workspaceId: string,
+  fileIds: readonly string[]
+): Promise<Set<string>> {
+  const admitted = await admitEach(principal, fileIds, async (ids) => {
+    const provenance = await getCurrentWorkspaceFileSecretProvenance(workspaceId, ids)
+    return ids.map((id) => ({
+      kind: 'workspace-file' as const,
+      id,
+      provenance: provenance.get(id) ?? { status: 'unknown' as const },
+      view: 'opaque' as const,
+    }))
+  })
+  return new Set(admitted)
+}
+
 export const getWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
   operation: fileOperations.readShare,
   resolveContext: ({ input }: { input: GetWorkspaceFileShareInput }) =>
     resolveActiveWorkspaceFileContext(input),
-  async execute({ context }): Promise<GetWorkspaceFileShareResult> {
+  async execute({ context, principal }): Promise<GetWorkspaceFileShareResult> {
     const share = await getShareForResource('file', context.fileId)
+    const active = share?.isActive ? [context.fileId] : []
+    const visible = await admitSharedFiles(principal, context.workspaceId, active)
+    if (active.length > visible.size) throw new ContentRefusedError('workspace-file')
     return { share }
   },
 })
@@ -84,7 +115,7 @@ export const getWorkspaceFileShares = defineAuthorizedWorkspaceFileUseCase({
     if (!workspace) throw new OrchestrationError('not_found', 'Workspace not found')
     return workspace
   },
-  async execute({ input, context }): Promise<GetWorkspaceFileSharesResult> {
+  async execute({ input, context, principal }): Promise<GetWorkspaceFileSharesResult> {
     const fileIds = [...new Set(input.fileIds)]
     if (fileIds.length > MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS) {
       throw new OrchestrationError(
@@ -92,8 +123,16 @@ export const getWorkspaceFileShares = defineAuthorizedWorkspaceFileUseCase({
         `Cannot read shares for more than ${MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS} files`
       )
     }
+    const shares = await getWorkspaceSharesForResources('file', context.workspaceId, fileIds)
+    const admitted = await admitSharedFiles(
+      principal,
+      context.workspaceId,
+      [...shares].filter(([, share]) => share.isActive).map(([fileId]) => fileId)
+    )
     return {
-      shares: await getWorkspaceSharesForResources('file', context.workspaceId, fileIds),
+      shares: new Map(
+        [...shares].filter(([fileId, share]) => !share.isActive || admitted.has(fileId))
+      ),
     }
   },
 })
@@ -149,6 +188,10 @@ export const updateWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
     const effectiveAuthType = input.authType ?? existingShare?.authType ?? 'public'
     if (input.isActive) {
       await validatePublicFileSharing(userId, context.workspaceId, effectiveAuthType)
+      /** A link serves the file's raw bytes to whoever opens it, past any redaction (D1). */
+      await requireAdmittedWorkspaceFile(principal, context.workspaceId, context.file, 'opaque')
+    } else {
+      await admitContent(principal, [])
     }
 
     const password =
diff --git a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
index 6385bb119b9..d9f486f5539 100644
--- a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   ContentVersionConflictError,
@@ -120,7 +121,10 @@ const admitUpdateWorkspaceFileContentUseCase = defineAuthorizedWorkspaceFileUseC
   operation: fileOperations.updateContent,
   resolveContext: ({ principal, input }: { principal: Principal; input: { fileId: string } }) =>
     resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  async execute() {},
+  /** Admission only; nothing is read. */
+  async execute({ principal }) {
+    await admitContent(principal, [])
+  },
 })
 
 export async function admitUpdateWorkspaceFileContent(
@@ -140,6 +144,8 @@ export const updateWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     input: UpdateWorkspaceFileContentInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
   async execute({ principal, input, context }): Promise<UpdateWorkspaceFileContentResult> {
+    /** A replacement writes the caller's bytes and returns the file's metadata, never its content. */
+    await admitContent(principal, [])
     const content = Buffer.from(input.content, input.encoding === 'base64' ? 'base64' : 'utf-8')
     if (content.length > MAX_WORKSPACE_FILE_CONTENT_BYTES) {
       throw new OrchestrationError(
@@ -166,12 +172,14 @@ export const updateWorkspaceFileContentFromBuffer = defineAuthorizedWorkspaceFil
     principal: Principal
     input: UpdateWorkspaceFileContentBufferInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  execute: ({ principal, input, context }) =>
-    updateAuthorizedWorkspaceFileContent({
+  async execute({ principal, input, context }) {
+    await admitContent(principal, [])
+    return updateAuthorizedWorkspaceFileContent({
       principal,
       input,
       content: input.content,
       canonical: context,
-    }),
+    })
+  },
   projectAudit: ({ result }) => projectUpdateWorkspaceFileContentAudit(result),
 })
diff --git a/apps/sim/lib/workspaces/application/inbox-settings.ts b/apps/sim/lib/workspaces/application/inbox-settings.ts
index ae81c7a2bd6..ff120a4c4f3 100644
--- a/apps/sim/lib/workspaces/application/inbox-settings.ts
+++ b/apps/sim/lib/workspaces/application/inbox-settings.ts
@@ -16,6 +16,7 @@ export const inboxSettingsOperations = {
     id: 'workspace_inbox.read',
     minimumRole: 'read',
     capability: 'inbox.use',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
@@ -24,6 +25,7 @@ export const inboxSettingsOperations = {
     id: 'workspace_inbox.update',
     minimumRole: 'admin',
     capability: 'inbox.use',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/workspaces/application/manage-permissions.ts b/apps/sim/lib/workspaces/application/manage-permissions.ts
index 05f8723bdd3..6ba6c84e6e7 100644
--- a/apps/sim/lib/workspaces/application/manage-permissions.ts
+++ b/apps/sim/lib/workspaces/application/manage-permissions.ts
@@ -24,6 +24,7 @@ export const workspacePermissionOperations = {
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'none',
   }),
   /** permission-group-exempt: workspace administrators manage existing collaborator roles. */
   update: defineWorkspaceOperation({
@@ -33,6 +34,7 @@ export const workspacePermissionOperations = {
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 
diff --git a/apps/sim/lib/workspaces/application/operations.ts b/apps/sim/lib/workspaces/application/operations.ts
index 6700b46eb07..f7d23bb3493 100644
--- a/apps/sim/lib/workspaces/application/operations.ts
+++ b/apps/sim/lib/workspaces/application/operations.ts
@@ -23,6 +23,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -33,6 +34,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/workspaces/application/organization-operations.ts b/apps/sim/lib/workspaces/application/organization-operations.ts
index 197cfccfaa1..50e13a88994 100644
--- a/apps/sim/lib/workspaces/application/organization-operations.ts
+++ b/apps/sim/lib/workspaces/application/organization-operations.ts
@@ -3,6 +3,7 @@ import { defineOrganizationOperation } from '@/lib/core/application/organization
 export const organizationWorkspaceOperations = {
   list: defineOrganizationOperation({
     id: 'organization.workspaces.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'organization_delegated'],
@@ -11,6 +12,7 @@ export const organizationWorkspaceOperations = {
   }),
   create: defineOrganizationOperation({
     id: 'organization.workspaces.create',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'workspace.create',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/workspaces/application/remove-member.ts b/apps/sim/lib/workspaces/application/remove-member.ts
index 94a7f0110b7..6b1fb7990de 100644
--- a/apps/sim/lib/workspaces/application/remove-member.ts
+++ b/apps/sim/lib/workspaces/application/remove-member.ts
@@ -12,6 +12,7 @@ export const removeWorkspaceMemberOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: ['session', 'delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/workspaces/operations/operations.ts b/apps/sim/lib/workspaces/operations/operations.ts
index 3395e64c8fd..31f44c87c5f 100644
--- a/apps/sim/lib/workspaces/operations/operations.ts
+++ b/apps/sim/lib/workspaces/operations/operations.ts
@@ -10,6 +10,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index 32360f8e6cd..a00074a0cf0 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -1536,6 +1536,14 @@ async function consumePrivateToolResponseMetadata(
   }
 }
 
+/**
+ * Whether a tool's result carries secret provenance its caller must project: it reads stored
+ * content (workspace files, knowledge, tables, memory), runs code, or calls an MCP server.
+ */
+export function toolResultCarriesSecretProvenance(toolId: string): boolean {
+  return getPrivateToolMetadataPolicy(toolId) !== undefined
+}
+
 function getPrivateToolMetadataPolicy(toolId: string): PrivateToolMetadataPolicy | undefined {
   const normalizedToolId = normalizeToolId(toolId)
   if (normalizedToolId === 'file_get_content' || isMcpTool(normalizedToolId)) {
diff --git a/packages/testing/src/mocks/tools.mock.ts b/packages/testing/src/mocks/tools.mock.ts
index 5c3186b3675..f4c3c370b9b 100644
--- a/packages/testing/src/mocks/tools.mock.ts
+++ b/packages/testing/src/mocks/tools.mock.ts
@@ -36,6 +36,8 @@ export const toolsMockFns = {
   mockExecuteTool: vi.fn(),
   /** Defaults to the real `__`-field stripping semantics. */
   mockPostProcessToolOutput: vi.fn(postProcessToolOutput),
+  /** Defaults to `false`: no tool's result carries provenance until a test says so. */
+  mockToolResultCarriesSecretProvenance: vi.fn((_toolId: string) => false),
 }
 
 /**
@@ -49,4 +51,5 @@ export const toolsMockFns = {
 export const toolsMock = {
   executeTool: toolsMockFns.mockExecuteTool,
   postProcessToolOutput: toolsMockFns.mockPostProcessToolOutput,
+  toolResultCarriesSecretProvenance: toolsMockFns.mockToolResultCarriesSecretProvenance,
 }
diff --git a/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts b/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
index e0b48379187..cfe90e177e4 100644
--- a/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
+++ b/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
@@ -96,10 +96,12 @@ export const workspaceFileSecretProvenanceMockFns = {
   mockMarkWorkspaceFileSecretProvenanceUnknown: vi.fn(),
   mockGetBoundWorkspaceFileSecretProvenance: vi.fn(),
   mockGetBoundWorkspaceFileSecretProvenanceByMetadata: vi.fn(),
+  mockGetBoundWorkspaceFileSecretProvenanceByIdentity: vi.fn(),
+  mockGetCurrentWorkspaceFileSecretProvenance: vi.fn(),
+  mockGetStoredFileSecretProvenanceByKey: vi.fn(),
   mockImportWorkspaceFileSecretProvenanceForModelView: vi.fn(),
   mockIsOpaqueWorkspaceFileEgressSafe: vi.fn(),
   mockImportWorkspaceFileSecretProvenanceForRuntime: vi.fn(),
-  mockImportWorkspaceFileSnapshotProvenance: vi.fn(),
   mockFilterModelSafeWorkspaceFileAttachments: vi.fn(),
   mockIsModelSafeWorkspaceFileKey: vi.fn(),
   mockAreModelSafeWorkspaceFileKeys: vi.fn(),
@@ -142,12 +144,15 @@ export const workspaceFileSecretProvenanceMock = {
   getBoundWorkspaceFileSecretProvenance: fns.mockGetBoundWorkspaceFileSecretProvenance,
   getBoundWorkspaceFileSecretProvenanceByMetadata:
     fns.mockGetBoundWorkspaceFileSecretProvenanceByMetadata,
+  getBoundWorkspaceFileSecretProvenanceByIdentity:
+    fns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity,
+  getCurrentWorkspaceFileSecretProvenance: fns.mockGetCurrentWorkspaceFileSecretProvenance,
+  getStoredFileSecretProvenanceByKey: fns.mockGetStoredFileSecretProvenanceByKey,
   importWorkspaceFileSecretProvenanceForModelView:
     fns.mockImportWorkspaceFileSecretProvenanceForModelView,
   isOpaqueWorkspaceFileEgressSafe: fns.mockIsOpaqueWorkspaceFileEgressSafe,
   importWorkspaceFileSecretProvenanceForRuntime:
     fns.mockImportWorkspaceFileSecretProvenanceForRuntime,
-  importWorkspaceFileSnapshotProvenance: fns.mockImportWorkspaceFileSnapshotProvenance,
   filterModelSafeWorkspaceFileAttachments: fns.mockFilterModelSafeWorkspaceFileAttachments,
   isModelSafeWorkspaceFileKey: fns.mockIsModelSafeWorkspaceFileKey,
   areModelSafeWorkspaceFileKeys: fns.mockAreModelSafeWorkspaceFileKeys,
diff --git a/scripts/check-unused-exports.baseline.json b/scripts/check-unused-exports.baseline.json
index b06798f4f11..becb5744f4c 100644
--- a/scripts/check-unused-exports.baseline.json
+++ b/scripts/check-unused-exports.baseline.json
@@ -4405,8 +4405,6 @@
   "apps/sim/lib/execution/code-placeholders/javascript.ts#DirectEnvironmentRead",
   "apps/sim/lib/execution/constants.ts#BINARY_DOC_TASKS",
   "apps/sim/lib/execution/constants.ts#MAX_DOCUMENT_PREVIEW_CODE_BYTES",
-  "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceRefusalCause",
-  "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceSurface",
   "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceWriteCause",
   "apps/sim/lib/execution/execution-signal.ts#ExecutionSignalHandler",
   "apps/sim/lib/execution/files.ts#processExecutionFile",

From c7d81b0a9ac62de5f8ea45c76508c8055352b6b5 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 12 Oct 2026 14:20:10 -0700
Subject: [PATCH 03/13] fix(mothership): address review round on content
 delivery

Committed writes answer saved-not-shown instead of a retryable error, keep
their panel refresh, and account per operation. Chat streams pin inline
bytes off, taint needs a registry, compile admits before its cache, owned
files bind to their context, and count/truncation oracles are closed for
Chat in knowledge, files search and row search. Table selection cells are
projected before escaping and coerced import cells keep their taint.
---
 .claude/rules/sim-content-delivery.md         |  11 +-
 .cursor/rules/sim-content-delivery.mdc        |   2 +-
 .../core/application/content-delivery.test.ts |  41 +++++-
 .../lib/core/application/content-delivery.ts  |  83 ++++++++---
 ...xecution-archive-provenance.integration.ts |   6 +
 .../application/admit-knowledge-content.ts    |   9 +-
 .../lib/knowledge/application/chunks.test.ts  |  71 ++++++++-
 apps/sim/lib/knowledge/application/chunks.ts  |  12 +-
 .../knowledge/application/connectors.test.ts  |  36 ++++-
 .../lib/knowledge/application/connectors.ts   |  17 ++-
 .../knowledge/application/documents.test.ts   |  65 +++++++++
 .../lib/knowledge/application/documents.ts    |  17 ++-
 .../lib/knowledge/application/tags.test.ts    | 110 ++++++++++++++
 apps/sim/lib/knowledge/application/tags.ts    |  91 ++++++++++--
 .../content-delivery-compat.baseline.json     |   2 +-
 .../content-delivery-compat.integration.ts    |   7 +-
 .../agent-cli/resource-effects.test.ts        |  13 ++
 .../mothership/agent-cli/resource-effects.ts  |   9 +-
 .../chat/application/inline-images.ts         |   7 +-
 .../mothership/chat/process-contents.test.ts  |  44 ++++++
 .../lib/mothership/chat/process-contents.ts   |  19 ++-
 .../content-delivery/dispatch.test.ts         |  26 +++-
 .../mothership/content-delivery/dispatch.ts   |  20 ++-
 .../content-delivery/registry-gate.test.ts    |   6 +-
 .../content-delivery/registry-gate.ts         |   5 +-
 .../content-delivery/session-gate.test.ts     |   1 -
 .../tools/sandbox-resource-transport.ts       |  16 +-
 .../tools/server/files/doc-compile.ts         |   9 +-
 apps/sim/lib/table/application/rows.test.ts   |  47 ++++++
 apps/sim/lib/table/application/rows.ts        |  10 +-
 apps/sim/lib/table/import-data.ts             |   8 +-
 apps/sim/lib/table/import-provenance.test.ts  |  91 ++++++++++++
 apps/sim/lib/table/import-provenance.ts       |  50 ++++++-
 apps/sim/lib/table/import-runner.ts           |   3 +-
 .../workspace-file-secret-provenance.ts       |   4 +-
 .../application/admit-run-files.test.ts       |  19 +--
 .../workflows/application/admit-run-files.ts  |   4 +-
 .../application/admit-file-content.ts         |  14 +-
 .../download-workspace-file-items.test.ts     |  33 +++++
 .../download-workspace-file-items.ts          |   8 +-
 .../read-workspace-file-record.test.ts        |  47 ++++++
 .../search-workspace-file-content.test.ts     | 137 ++++++++++++++++++
 .../search-workspace-file-content.ts          |  21 ++-
 43 files changed, 1150 insertions(+), 101 deletions(-)
 create mode 100644 apps/sim/lib/table/import-provenance.test.ts

diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
index 561682b6f9f..becfa8f8efd 100644
--- a/.claude/rules/sim-content-delivery.md
+++ b/.claude/rules/sim-content-delivery.md
@@ -1,12 +1,17 @@
 ---
 description: How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content.
 paths:
-  - "apps/sim/lib/core/application/content-delivery.ts"
+  - "apps/sim/lib/core/application/**"
   - "apps/sim/lib/mothership/content-delivery/**"
-  - "apps/sim/lib/**/application/admit-*.ts"
+  - "apps/sim/lib/workspace-files/application/**"
+  - "apps/sim/lib/knowledge/application/**"
+  - "apps/sim/lib/table/application/**"
+  - "apps/sim/lib/workflows/application/**"
+  - "apps/sim/lib/mothership/chat/application/**"
   - "apps/sim/lib/**/application/operations.ts"
   - "apps/sim/lib/mothership/agent-cli/**"
-  - "apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"
+  - "apps/sim/lib/mothership/tools/**"
+  - "apps/sim/app/api/v2/**"
 ---
 
 # Sim Content Delivery to Chat
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
index 62e2784eaf4..b1bf6e7aa12 100644
--- a/.cursor/rules/sim-content-delivery.mdc
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -1,6 +1,6 @@
 ---
 description: "How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content."
-globs: ["apps/sim/lib/core/application/content-delivery.ts","apps/sim/lib/mothership/content-delivery/**","apps/sim/lib/**/application/admit-*.ts","apps/sim/lib/**/application/operations.ts","apps/sim/lib/mothership/agent-cli/**","apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"]
+globs: ["apps/sim/lib/core/application/**","apps/sim/lib/mothership/content-delivery/**","apps/sim/lib/workspace-files/application/**","apps/sim/lib/knowledge/application/**","apps/sim/lib/table/application/**","apps/sim/lib/workflows/application/**","apps/sim/lib/mothership/chat/application/**","apps/sim/lib/**/application/operations.ts","apps/sim/lib/mothership/agent-cli/**","apps/sim/lib/mothership/tools/**","apps/sim/app/api/v2/**"]
 ---
 
 <!-- Generated from .claude/rules/sim-content-delivery.md by `bun run skills:sync`. Edit the source, not this file. -->
diff --git a/apps/sim/lib/core/application/content-delivery.test.ts b/apps/sim/lib/core/application/content-delivery.test.ts
index 289c1684b50..46bd4890c98 100644
--- a/apps/sim/lib/core/application/content-delivery.test.ts
+++ b/apps/sim/lib/core/application/content-delivery.test.ts
@@ -208,7 +208,7 @@ describe('runDeclaredContentOperation', () => {
     expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
   })
 
-  it('answers with a gate failure during a write only after its effects completed', async () => {
+  it('answers a write whose gate failed as saved-not-shown, after its effects completed', async () => {
     const failure = new Error('history unavailable')
     const failing: ContentDeliveryGate = {
       async admit() {
@@ -231,7 +231,37 @@ describe('runDeclaredContentOperation', () => {
       ).catch((error: unknown) => error)
     )
     expect(events).toEqual(['withheld=1', 'audit recorded'])
-    expect(outcome).toBe(failure)
+    /** Not the gate's error: that would invite a retry of a write that already committed. */
+    expect(outcome).toBeInstanceOf(ContentRefusedError)
+    expect(outcome).toMatchObject({ message: expect.stringContaining('The change was saved') })
+    /** The request's transport still sees the failure, to answer it itself (the proxy's 502). */
+    const record = await observeContentDelivery(failing, () =>
+      trackContentDelivery(() =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitWrittenContent(CHAT, [source('written')])
+          return 'saved row'
+        }).catch(() => 'answered')
+      )
+    )
+    expect(record.gateFailure).toBe(failure)
+  })
+
+  it('does not let a nested use case account for what its enclosing operation returns', async () => {
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    const outcome = await observeContentDelivery(admitAll, () =>
+      runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [source('nested')])
+          return 'nested'
+        })
+        return 'outer content never classified'
+      }).catch((error: unknown) => error)
+    )
+    expect(outcome).toBeInstanceOf(ContentDeliveryUnaccountedError)
   })
 
   it('rethrows a gate failure at once when no operation is open to answer with it', async () => {
@@ -265,7 +295,12 @@ describe('trackContentDelivery', () => {
       noteContentDeliveryOperation(SOURCED, CHAT)
       return 'response'
     })
-    expect(record).toEqual({ result: 'response', unaccounted: true, admitted: [] })
+    expect(record).toEqual({
+      result: 'response',
+      unaccounted: true,
+      committedWrite: false,
+      admitted: [],
+    })
   })
 
   it('does not report a none operation, or a sourced one another caller ran', async () => {
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
index 3a0ed48e7d3..4d2698c71a6 100644
--- a/apps/sim/lib/core/application/content-delivery.ts
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -64,8 +64,6 @@ interface ContentLedger {
   admitted: ContentProvenance[]
   /** A committed write's returned item was refused; the operation answers with a refusal. */
   withheldAfterWrite?: ContentSourceKind
-  /** A committed write's gate failed; the operation completes, then answers with this error. */
-  failedAfterWrite?: unknown
   /** The gate itself failed while this ledger was open, whatever the route then answered. */
   gateFailure?: unknown
 }
@@ -185,8 +183,24 @@ export class ContentAdmission {
   }
 }
 
+/**
+ * Accounts for the operation running now and the requests around it. An enclosing operation is
+ * not marked: a nested use case's admission covers what it returned, not what the outer one adds.
+ */
 function markAccounted(): void {
-  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) ledger.accounted = true
+  const current = ledgers.getStore()
+  if (!current) return
+  current.accounted = true
+  for (let ledger = current.parent; ledger; ledger = ledger.parent) {
+    if (ledger.declaration === undefined) ledger.accounted = true
+  }
+}
+
+/** A committed write returned an item of `kind` its gate refused or could not decide. */
+function withholdAfterWrite(kind: ContentSourceKind): void {
+  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
+    ledger.withheldAfterWrite ??= kind
+  }
 }
 
 /**
@@ -254,25 +268,20 @@ export async function admitWrittenContent(
     admission = await admitContent(principal, sources)
   } catch (error) {
     /**
-     * A gate that cannot decide (its record could not be written) must not undo the write's
-     * audit and effects either: every item is withheld, and the operation answers with the error.
+     * A gate that cannot decide (its record could not be written) must not undo the write's audit
+     * and effects either: every item is withheld, and the operation answers "saved, not shown".
+     * A transport that must answer the failure itself reads it from the request's ledger.
      */
-    const ledger = ledgers.getStore()
-    if (!ledger) throw error
-    for (let open: ContentLedger | undefined = ledger; open; open = open.parent) {
-      open.failedAfterWrite ??= error
-    }
+    const [first] = sources
+    if (!ledgers.getStore() || !first) throw error
+    withholdAfterWrite(first.kind)
     return new ContentAdmission(
       sources,
       sources.map(() => false)
     )
   }
   const refused = admission.refused[0]
-  if (refused) {
-    for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
-      ledger.withheldAfterWrite ??= refused.kind
-    }
-  }
+  if (refused) withholdAfterWrite(refused.kind)
   return admission
 }
 
@@ -285,14 +294,28 @@ export async function admitEach<T>(
   principal: Principal,
   items: readonly T[],
   classify: (items: readonly T[]) => Promise<readonly ContentSource[]>,
-  options: { written?: boolean } = {}
+  options: { written?: ContentSourceKind } = {}
 ): Promise<T[]> {
   if (items.length === 0 || !mustClassifyContent(principal)) {
     await admitContent(principal, [])
     return [...items]
   }
-  const sources = await classify(items)
-  const admission = await (options.written ? admitWrittenContent : admitContent)(principal, sources)
+  if (!options.written) {
+    const sources = await classify(items)
+    const admission = await admitContent(principal, sources)
+    return items.filter((_, index) => admission.admits(sources[index]))
+  }
+  /** A committed write whose items cannot even be classified is saved, then withheld whole. */
+  let sources: readonly ContentSource[]
+  try {
+    sources = await classify(items)
+  } catch (error) {
+    if (!ledgers.getStore()) throw error
+    markAccounted()
+    withholdAfterWrite(options.written)
+    return []
+  }
+  const admission = await admitWrittenContent(principal, sources)
   return items.filter((_, index) => admission.admits(sources[index]))
 }
 
@@ -308,6 +331,17 @@ export async function requireAdmittedContent(
   if (!admission.admits(source)) throw new ContentRefusedError(source.kind)
 }
 
+/** The gate failed during a dispatched request, which may have committed a write first. */
+export class ContentGateFailure extends Error {
+  constructor(
+    readonly gateFailure: unknown,
+    readonly committedWrite: boolean
+  ) {
+    super('The content gate failed during the request', { cause: gateFailure })
+    this.name = 'ContentGateFailure'
+  }
+}
+
 /** What one dispatched request delivered, as the transport that dispatched it needs to know. */
 export interface ContentDeliveryRecord<T> {
   result: T
@@ -315,6 +349,8 @@ export interface ContentDeliveryRecord<T> {
   unaccounted: boolean
   /** The gate failed to decide during the request; see {@link ContentLedger.gateFailure}. */
   gateFailure?: unknown
+  /** A write committed, then its returned content was withheld: the change happened. */
+  committedWrite: boolean
   /** Provenance of every admitted item, in admission order. */
   admitted: readonly ContentProvenance[]
 }
@@ -333,10 +369,18 @@ export async function trackContentDelivery<T>(
     accounted: false,
     admitted: [],
   }
-  const result = await ledgers.run(ledger, execute)
+  let result: T
+  try {
+    result = await ledgers.run(ledger, execute)
+  } catch (error) {
+    /** The request threw because its gate failed; its transport answers that, not the error. */
+    if (ledger.gateFailure === undefined) throw error
+    throw new ContentGateFailure(ledger.gateFailure, ledger.withheldAfterWrite !== undefined)
+  }
   return {
     result,
     unaccounted: ledger.sourcedOperationAdmitted && !ledger.accounted,
+    committedWrite: ledger.withheldAfterWrite !== undefined,
     admitted: ledger.admitted,
     ...(ledger.gateFailure === undefined ? {} : { gateFailure: ledger.gateFailure }),
   }
@@ -381,7 +425,6 @@ export async function runDeclaredContentOperation<T>(
   }
   const result = await ledgers.run(ledger, execute)
   await complete?.(result)
-  if (ledger.failedAfterWrite) throw ledger.failedAfterWrite
   if (operation.contentDelivery === 'sourced' && !ledger.accounted) {
     throw new ContentDeliveryUnaccountedError(operation.id)
   }
diff --git a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
index c9f2e1f4cad..137e80f244b 100644
--- a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
@@ -209,6 +209,12 @@ async function assertBlockedConsumers(
   } else {
     expect(imported).toMatchObject({ failed: [] })
     expect(imported.added).toHaveLength(1)
+    /** The accepted document queued its processing; that work is removed with the fixture. */
+    const events = await db
+      .select({ id: outboxEvent.id })
+      .from(outboxEvent)
+      .where(sql`${outboxEvent.payload}::jsonb ->> 'documentId' = ${imported.added[0].documentId}`)
+    trackedEventIds.push(...events.map((event) => event.id))
   }
 }
 
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
index 8edfd31062b..d4386423f81 100644
--- a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -1,5 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import { admitEach } from '@/lib/core/application/content-delivery'
+import { admitEach, type ContentSourceKind } from '@/lib/core/application/content-delivery'
 import {
   classifyKnowledgeChunks,
   classifyKnowledgeDocumentMetadata,
@@ -10,6 +10,9 @@ interface KnowledgeAdmissionOptions {
   written?: boolean
 }
 
+const writtenAs = (options: KnowledgeAdmissionOptions, kind: ContentSourceKind) =>
+  options.written ? { written: kind } : {}
+
 /**
  * Admits each document whose rendered metadata a result returns, on its own, and returns the ids
  * admitted. `value` is what the result shows of the document, so only secrets it contains are
@@ -32,7 +35,7 @@ export async function admitKnowledgeDocuments(
         view: { derived: item.value },
       }))
     },
-    options
+    writtenAs(options, 'knowledge-document')
   )
   return new Set(admitted.map((item) => item.id))
 }
@@ -59,7 +62,7 @@ export async function admitKnowledgeChunks(
         view: chunk.value === undefined ? ('complete' as const) : { derived: chunk.value },
       }))
     },
-    options
+    writtenAs(options, 'knowledge-chunk')
   )
   return new Set(admitted.map((chunk) => chunk.id))
 }
diff --git a/apps/sim/lib/knowledge/application/chunks.test.ts b/apps/sim/lib/knowledge/application/chunks.test.ts
index 5b7121d60f4..0a23a8088a4 100644
--- a/apps/sim/lib/knowledge/application/chunks.test.ts
+++ b/apps/sim/lib/knowledge/application/chunks.test.ts
@@ -1,4 +1,8 @@
-import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import type { Principal } from '@sim/auth/principal'
+import {
+  createDelegatedPrincipal,
+  createSessionPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import {
   knowledgeContextsMock,
   knowledgeContextsMockFns,
@@ -8,6 +12,7 @@ import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/wo
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  admitKnowledgeChunks: vi.fn(),
   queryChunks: vi.fn(),
   batchChunkOperation: vi.fn(),
   createChunk: vi.fn(),
@@ -36,6 +41,11 @@ vi.mock('@/lib/knowledge/model-input-provenance', () => ({
 
 vi.mock('@/providers/utils', () => providersUtilsMock)
 
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => ({
+  admitKnowledgeChunks: mocks.admitKnowledgeChunks,
+}))
+
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
@@ -57,6 +67,65 @@ describe('knowledge chunk application use cases', () => {
     })
   })
 
+  /** Stands in for the gate's verdicts; accounting is the real primitive's, as the helper's is. */
+  function admitOnly(ids: string[]) {
+    mocks.admitKnowledgeChunks.mockImplementation(async (principal: Principal) => {
+      await admitContent(principal, [])
+      return new Set(ids)
+    })
+  }
+
+  describe('a searched chunk listing', () => {
+    const page = {
+      chunks: [
+        { id: 'chunk-1', content: 'first' },
+        { id: 'chunk-2', content: 'second' },
+      ],
+      pagination: { total: 7, limit: 2, offset: 4, hasMore: true },
+    }
+
+    beforeEach(() => {
+      knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue(
+        {
+          workspaceId: 'workspace-1',
+          workspaceOrganizationId: null,
+          allowPersonalApiKeys: true,
+          billedAccountUserId: 'billing-owner-1',
+          access: { get: async () => WORKSPACE_ACCESS_SCOPE },
+          knowledgeBaseId: 'knowledge-1',
+          knowledgeBase: { id: 'knowledge-1' },
+          documentId: 'document-1',
+          document: { id: 'document-1', processingStatus: 'completed', enabled: true },
+        }
+      )
+      mocks.queryChunks.mockResolvedValue(page)
+      admitOnly(['chunk-1'])
+    })
+
+    it('reports Chat a total of the matches it was given, not of withheld ones', async () => {
+      const result = await listKnowledgeChunks.execute({
+        principal: createDelegatedPrincipal({
+          workspaceId: 'workspace-1',
+          audience: 'sim:knowledge',
+        }),
+        input: { knowledgeBaseId: 'knowledge-1', documentId: 'document-1', search: 'token' },
+      })
+
+      expect(result.chunks.map((chunk) => chunk.id)).toEqual(['chunk-1'])
+      expect(result.pagination).toEqual({ total: 5, limit: 2, offset: 4, hasMore: true })
+    })
+
+    it('keeps the full total for a person', async () => {
+      admitOnly(['chunk-1', 'chunk-2'])
+      const result = await listKnowledgeChunks.execute({
+        principal: createSessionPrincipal(),
+        input: { knowledgeBaseId: 'knowledge-1', documentId: 'document-1', search: 'token' },
+      })
+
+      expect(result.pagination).toEqual(page.pagination)
+    })
+  })
+
   it('returns a typed transient failure before querying chunks for a processing document', async () => {
     const promise = listKnowledgeChunks.execute({
       principal: createSessionPrincipal(),
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index 9adef79d2d2..de58204d7bb 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -1,6 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
-import { ContentRefusedError } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -159,9 +159,17 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
         value: chunk,
       }))
     )
+    const chunks = result.chunks.filter((chunk) => admitted.has(chunk.id))
     return {
       ...result,
-      chunks: result.chunks.filter((chunk) => admitted.has(chunk.id)),
+      chunks,
+      /**
+       * A search total counts every matching chunk, refused ones included, so for Chat it would
+       * say whether withheld text matched. Chat sees only the matches it was given.
+       */
+      ...(filters.search && isCopilotPrincipal(principal)
+        ? { pagination: { ...result.pagination, total: result.pagination.offset + chunks.length } }
+        : {}),
       workspaceId: context.workspaceId,
       documentId,
     }
diff --git a/apps/sim/lib/knowledge/application/connectors.test.ts b/apps/sim/lib/knowledge/application/connectors.test.ts
index 630893c5e51..e6c1b635328 100644
--- a/apps/sim/lib/knowledge/application/connectors.test.ts
+++ b/apps/sim/lib/knowledge/application/connectors.test.ts
@@ -1,5 +1,5 @@
 import { member } from '@sim/db/schema'
-import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
+import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import { authOAuthUtilsMock, authOAuthUtilsMockFns } from '@sim/testing/mocks/auth-oauth-utils.mock'
@@ -116,6 +116,7 @@ import * as encryption from '@/lib/core/security/encryption'
 import {
   createKnowledgeConnector,
   deleteKnowledgeConnector,
+  listKnowledgeConnectorDocuments,
   resolveConnectorCredentialAccessToken,
   syncKnowledgeConnector,
   updateKnowledgeConnector,
@@ -309,6 +310,39 @@ describe('knowledge connector application use cases', () => {
 
   afterAll(resetDbChainMock)
 
+  describe('a searched connector document listing', () => {
+    /** The statements the listing ran whose conditions bind the search pattern. */
+    function searchedStatements(): number {
+      return dbChainMockFns.where.mock.calls.filter(([condition]) =>
+        JSON.stringify(condition, (_key, value) =>
+          value && typeof value.toSQL === 'function' ? value.toSQL() : value
+        ).includes('%report%')
+      ).length
+    }
+
+    async function list(
+      principal: Parameters<typeof listKnowledgeConnectorDocuments.execute>[0]['principal']
+    ) {
+      queueTableRows(schemaMock.document, [{ active: 4, excluded: 1, failed: 0, skipped: 0 }])
+      queueTableRows(schemaMock.document, [])
+      return listKnowledgeConnectorDocuments.execute({
+        principal,
+        input: { knowledgeBaseId: 'knowledge-b', connectorId: 'connector-b', search: 'report' },
+      })
+    }
+
+    it('counts the whole source for Chat, so withheld names cannot answer the search', async () => {
+      workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('read')
+      await list({ ...delegatedPrincipal, workspaceId: 'workspace-b' })
+      expect(searchedStatements()).toBe(1)
+    })
+
+    it('counts only the matches for a person, as before', async () => {
+      await list(createSessionPrincipal())
+      expect(searchedStatements()).toBe(2)
+    })
+  })
+
   it('rejects a forged OAuth credential for central Drive creation before using its token', async () => {
     workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('admin')
     knowledgeContextsMockFns.mockResolveActiveKnowledgeBaseContext.mockResolvedValue({
diff --git a/apps/sim/lib/knowledge/application/connectors.ts b/apps/sim/lib/knowledge/application/connectors.ts
index 79394fd9621..c601bbeafa7 100644
--- a/apps/sim/lib/knowledge/application/connectors.ts
+++ b/apps/sim/lib/knowledge/application/connectors.ts
@@ -16,6 +16,7 @@ import { and, asc, desc, eq, inArray, isNull, lt, or, sql } from 'drizzle-orm'
 import type { ConnectorDocumentFilter } from '@/lib/api/contracts/knowledge/connectors'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
 import { requireCurrentHumanRole } from '@/lib/core/application'
+import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { resolvePrincipalEnvironmentVariable } from '@/lib/core/application/environment-reference'
 import { requireOrganizationMembership } from '@/lib/core/application/organization-authorization'
 import {
@@ -1219,15 +1220,21 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
     }
     const filter =
       input.filter ?? (input.failedOnly ? 'failed' : input.includeExcluded ? undefined : 'active')
-    const baseConditions = [
+    const scopeConditions = [
       eq(document.connectorId, context.connectorId),
       isNull(document.archivedAt),
       isNull(document.deletedAt),
       knowledgeAccessCondition(await context.access.get()),
-      search
-        ? sql`${document.filename} ILIKE ${`%${escapeLikePattern(search)}%`} ESCAPE '\\'`
-        : undefined,
     ] as const
+    const searchCondition = search
+      ? sql`${document.filename} ILIKE ${`%${escapeLikePattern(search)}%`} ESCAPE '\\'`
+      : undefined
+    const baseConditions = [...scopeConditions, searchCondition] as const
+    /**
+     * Searched counts include documents Chat is refused, so they would say whether a withheld name
+     * matched; Chat's counts cover the whole source, as an unsearched listing reports them.
+     */
+    const countConditions = isCopilotPrincipal(principal) ? scopeConditions : baseConditions
     const active = sql`${document.userExcluded} = false`
     /** One pass over the source's readable documents; excluded rows are scanned only when counted. */
     const [[counts], rows] = await Promise.all([
@@ -1241,7 +1248,7 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
         .from(document)
         .where(
           and(
-            ...baseConditions,
+            ...countConditions,
             input.filter || input.includeExcluded ? undefined : eq(document.userExcluded, false)
           )
         ),
diff --git a/apps/sim/lib/knowledge/application/documents.test.ts b/apps/sim/lib/knowledge/application/documents.test.ts
index 31ceaca2b64..07d1adbe6a4 100644
--- a/apps/sim/lib/knowledge/application/documents.test.ts
+++ b/apps/sim/lib/knowledge/application/documents.test.ts
@@ -68,6 +68,28 @@ vi.mock('@/lib/uploads/server/metadata', () => uploadsMetadataMock)
 
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 
+/** Chat's verdicts come from a stand-in gate (refusing `withheld-*` ids); other callers run the real helper. */
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import('@/lib/knowledge/application/admit-knowledge-content')>()
+  const delivery = await vi.importActual<typeof import('@/lib/core/application/content-delivery')>(
+    '@/lib/core/application/content-delivery'
+  )
+  return {
+    ...original,
+    admitKnowledgeDocuments: async (
+      principal: Parameters<typeof original.admitKnowledgeDocuments>[0],
+      documents: Parameters<typeof original.admitKnowledgeDocuments>[1]
+    ) => {
+      if (!delivery.isCopilotPrincipal(principal)) {
+        return original.admitKnowledgeDocuments(principal, documents)
+      }
+      await delivery.admitContent(principal, [])
+      return new Set(documents.map((doc) => doc.id).filter((id) => !id.startsWith('withheld-')))
+    },
+  }
+})
+
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import {
@@ -272,6 +294,49 @@ describe('knowledge document application use cases', () => {
     expect(mocks.deleteDocumentById).not.toHaveBeenCalled()
   })
 
+  describe('a filtered document listing', () => {
+    const page = {
+      documents: [{ id: 'document-1' }, { id: 'withheld-1' }],
+      pagination: { total: 9, limit: 2, offset: 2, hasMore: true },
+    }
+    const chat = {
+      kind: 'delegated' as const,
+      serviceId: 'copilot',
+      subjectUserId: 'user-1',
+      workspaceId: 'workspace-1',
+      delegationId: 'tool-call-1',
+      audience: 'sim:knowledge',
+      issuedAt: new Date(),
+      expiresAt: new Date(Date.now() + 60_000),
+    }
+    const input = { knowledgeBaseId: 'knowledge-1', limit: 2, offset: 2, search: 'secret' }
+
+    beforeEach(() => {
+      mocks.getDocuments.mockResolvedValue(page)
+    })
+
+    it('reports Chat a total of the matches it was given, not of withheld ones', async () => {
+      const result = await listKnowledgeDocuments.execute({ principal: chat, input })
+
+      expect(result.documents.map((doc: { id: string }) => doc.id)).toEqual(['document-1'])
+      expect(result.pagination).toEqual({ total: 3, limit: 2, offset: 2, hasMore: true })
+    })
+
+    it('keeps the full total for a person and for Chat without a filter', async () => {
+      const person = await listKnowledgeDocuments.execute({
+        principal: createSessionPrincipal(),
+        input,
+      })
+      expect(person.pagination).toEqual(page.pagination)
+
+      const unfiltered = await listKnowledgeDocuments.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-1', limit: 2, offset: 2 },
+      })
+      expect(unfiltered.pagination).toEqual(page.pagination)
+    })
+  })
+
   it('authorizes the canonical knowledge base before listing documents', async () => {
     await listKnowledgeDocuments.execute({
       principal: createSessionPrincipal(),
diff --git a/apps/sim/lib/knowledge/application/documents.ts b/apps/sim/lib/knowledge/application/documents.ts
index 3b6123a1e49..b8071b74675 100644
--- a/apps/sim/lib/knowledge/application/documents.ts
+++ b/apps/sim/lib/knowledge/application/documents.ts
@@ -9,7 +9,11 @@ import {
   checkAttributedUsageLimits,
 } from '@/lib/billing/core/billing-attribution'
 import { authorizeWorkspaceOperation } from '@/lib/core/application'
-import { admitContent, ContentRefusedError } from '@/lib/core/application/content-delivery'
+import {
+  admitContent,
+  ContentRefusedError,
+  isCopilotPrincipal,
+} from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
@@ -323,9 +327,18 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
       principal,
       result.documents.map((doc) => ({ id: doc.id, value: doc }))
     )
+    const documents = result.documents.filter((doc) => admitted.has(doc.id))
+    /**
+     * A filtered total counts every matching document, refused ones included, so for Chat it would
+     * say whether withheld names or tag values matched. Chat sees only the matches it was given.
+     */
+    const filtered = Boolean(input.search) || tagFilters.length > 0
     return {
       ...result,
-      documents: result.documents.filter((doc) => admitted.has(doc.id)),
+      documents,
+      ...(filtered && isCopilotPrincipal(principal)
+        ? { pagination: { ...result.pagination, total: offset + documents.length } }
+        : {}),
       tagDefinitions:
         resolvedNameFilters?.definitionsByKnowledgeBase.get(context.knowledgeBaseId) ??
         (await getDocumentTagDefinitions(context.knowledgeBaseId)),
diff --git a/apps/sim/lib/knowledge/application/tags.test.ts b/apps/sim/lib/knowledge/application/tags.test.ts
index 8cf227c05f7..4d142216b1d 100644
--- a/apps/sim/lib/knowledge/application/tags.test.ts
+++ b/apps/sim/lib/knowledge/application/tags.test.ts
@@ -1,3 +1,5 @@
+import type { Principal } from '@sim/auth/principal'
+import { queueTableRows, schemaMock } from '@sim/testing'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import {
@@ -19,11 +21,16 @@ vi.mock('@/lib/knowledge/application/contexts', () => knowledgeContextsMock)
 
 vi.mock('@/lib/knowledge/tags/service', () => knowledgeTagsServiceMock)
 
+const admission = vi.hoisted(() => ({ admitKnowledgeDocuments: vi.fn() }))
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => admission)
+
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import {
   createKnowledgeTag,
   deleteKnowledgeTag,
   listKnowledgeTags,
+  readDetailedKnowledgeTagUsage,
   readKnowledgeTagUsage,
   readNextKnowledgeTagSlot,
   updateKnowledgeTag,
@@ -353,4 +360,107 @@ describe('knowledge tag application use cases', () => {
       })
     }
   )
+
+  describe('tag usage Chat may see', () => {
+    const chat = { ...delegatedPrincipal, workspaceId: 'workspace-b' }
+    /** One document under two definitions: its value is refused under one and admitted under the other. */
+    const detailed = [
+      {
+        tagName: 'Region',
+        tagSlot: 'tag1',
+        documentCount: 2,
+        documents: [
+          { id: 'doc-shared', name: 'shared.csv', tagValue: 'refused' },
+          { id: 'doc-other', name: 'other.csv', tagValue: 'emea' },
+        ],
+      },
+      {
+        tagName: 'Owner',
+        tagSlot: 'tag2',
+        documentCount: 1,
+        documents: [{ id: 'doc-shared', name: 'shared.csv', tagValue: 'ops' }],
+      },
+    ]
+
+    beforeEach(() => {
+      mocks.resolvePermission.mockResolvedValue('read')
+      mocks.readDetailedUsage.mockResolvedValue(detailed)
+      /** Stands in for the gate: refuses an occurrence by the value it shows. */
+      admission.admitKnowledgeDocuments.mockImplementation(
+        async (principal: Principal, documents: { id: string; value: { tagValue: string } }[]) => {
+          await admitContent(principal, [])
+          return new Set(
+            documents.filter((doc) => doc.value.tagValue !== 'refused').map((doc) => doc.id)
+          )
+        }
+      )
+    })
+
+    it('decides each (definition, document) occurrence on its own', async () => {
+      const result = await readDetailedKnowledgeTagUsage.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+
+      expect(result.usage[0]).toMatchObject({
+        documentCount: 1,
+        documents: [{ id: 'doc-other' }],
+      })
+      expect(result.usage[1]).toBe(detailed[1])
+    })
+
+    it('counts for Chat only the documents it may see, chunks included', async () => {
+      mocks.readUsage.mockResolvedValue([
+        {
+          id: 'def-1',
+          tagSlot: 'tag1',
+          displayName: 'Region',
+          fieldType: 'text',
+          documentCount: 2,
+          chunkCount: 9,
+        },
+        {
+          id: 'def-2',
+          tagSlot: 'tag2',
+          displayName: 'Owner',
+          fieldType: 'text',
+          documentCount: 1,
+          chunkCount: 4,
+        },
+      ])
+      queueTableRows(schemaMock.embedding, [{ documentId: 'doc-shared', count: 4 }])
+
+      const result = await readKnowledgeTagUsage.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+
+      expect(result.usage).toEqual([
+        expect.objectContaining({ tagSlot: 'tag1', documentCount: 1, chunkCount: 5 }),
+        expect.objectContaining({ tagSlot: 'tag2', documentCount: 1, chunkCount: 4 }),
+      ])
+    })
+
+    it('leaves a person’s counts as stored, without reading documents', async () => {
+      const stats = [
+        {
+          id: 'def-1',
+          tagSlot: 'tag1',
+          displayName: 'Region',
+          fieldType: 'text',
+          documentCount: 2,
+          chunkCount: 9,
+        },
+      ]
+      mocks.readUsage.mockResolvedValue(stats)
+
+      const result = await readKnowledgeTagUsage.execute({
+        principal: sessionPrincipal,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+
+      expect(result.usage).toBe(stats)
+      expect(mocks.readDetailedUsage).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index ca325c663c6..107d4a0c378 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -1,7 +1,10 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
+import { db } from '@sim/db'
+import { embedding } from '@sim/db/schema'
 import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { inArray, sql } from 'drizzle-orm'
+import { admitContent, isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
@@ -351,15 +354,71 @@ export const deleteKnowledgeTag = defineAuthorizedKnowledgeUseCase({
   }),
 })
 
+/**
+ * The documents each tag definition lists, admitted per (definition, document) occurrence: a
+ * document shows a different tag value under each definition, so one occurrence's verdict says
+ * nothing about another's.
+ */
+async function admitTagUsage(
+  principal: Principal,
+  usage: Awaited<ReturnType<typeof getTagUsage>>
+): Promise<Awaited<ReturnType<typeof getTagUsage>>> {
+  const admitted = []
+  for (const definition of usage) {
+    const ids = await admitKnowledgeDocuments(
+      principal,
+      definition.documents.map((doc) => ({ id: doc.id, value: doc }))
+    )
+    const documents = definition.documents.filter((doc) => ids.has(doc.id))
+    admitted.push(
+      documents.length === definition.documents.length
+        ? definition
+        : { ...definition, documents, documentCount: documents.length }
+    )
+  }
+  return admitted
+}
+
 export const readKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
     resolveActiveKnowledgeResourceContext(input, principal),
   async execute({ principal, context }) {
-    /** Counts per tag definition only; no tag value or document leaves. */
-    await admitContent(principal, [])
+    const requestId = generateRequestId()
+    const usage = await getTagUsageStats(context.knowledgeBaseId, context.access, requestId)
+    if (!isCopilotPrincipal(principal)) {
+      await admitContent(principal, [])
+      return { usage }
+    }
+    /**
+     * A count says which documents carry a tag, so for Chat each definition counts only the
+     * documents it may see; a withheld document's chunks leave its chunk count with it.
+     */
+    const detailed = await getTagUsage(context.knowledgeBaseId, requestId, context.access)
+    const visible = await admitTagUsage(principal, detailed)
+    const withheld = new Map<string, string[]>()
+    detailed.forEach((definition, index) => {
+      const kept = new Set(visible[index].documents.map((doc) => doc.id))
+      const refused = definition.documents.filter((doc) => !kept.has(doc.id)).map((doc) => doc.id)
+      if (refused.length > 0) withheld.set(definition.tagSlot, refused)
+    })
+    if (withheld.size === 0) return { usage }
+    const chunkCounts = await countKnowledgeDocumentChunks([
+      ...new Set([...withheld.values()].flat()),
+    ])
     return {
-      usage: await getTagUsageStats(context.knowledgeBaseId, context.access, generateRequestId()),
+      usage: usage.map((stat) => {
+        const refused = withheld.get(stat.tagSlot)
+        if (!refused) return stat
+        return {
+          ...stat,
+          documentCount: Math.max(0, stat.documentCount - refused.length),
+          chunkCount: Math.max(
+            0,
+            stat.chunkCount - refused.reduce((sum, id) => sum + (chunkCounts.get(id) ?? 0), 0)
+          ),
+        }
+      }),
     }
   },
 })
@@ -370,21 +429,21 @@ export const readDetailedKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
     resolveActiveKnowledgeResourceContext(input, principal),
   async execute({ principal, context }) {
     const usage = await getTagUsage(context.knowledgeBaseId, generateRequestId(), context.access)
-    const admitted = await admitKnowledgeDocuments(
-      principal,
-      usage.flatMap((definition) => definition.documents.map((doc) => ({ id: doc.id, value: doc })))
-    )
-    return {
-      usage: usage.map((definition) => {
-        const documents = definition.documents.filter((doc) => admitted.has(doc.id))
-        return documents.length === definition.documents.length
-          ? definition
-          : { ...definition, documents, documentCount: documents.length }
-      }),
-    }
+    return { usage: await admitTagUsage(principal, usage) }
   },
 })
 
+/** Chunks per document, for the documents a tag count withholds. */
+async function countKnowledgeDocumentChunks(documentIds: string[]): Promise<Map<string, number>> {
+  if (documentIds.length === 0) return new Map()
+  const rows = await db
+    .select({ documentId: embedding.documentId, count: sql<number>`count(*)::int` })
+    .from(embedding)
+    .where(inArray(embedding.documentId, documentIds))
+    .groupBy(embedding.documentId)
+  return new Map(rows.map((row) => [row.documentId, Number(row.count)]))
+}
+
 export const readNextKnowledgeTagSlot = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readNextTagSlot,
   resolveContext: ({
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
index 599b668b736..86688907e65 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
@@ -615,7 +615,7 @@
           "maxRows": 9007199254740991,
           "name": "content_fixture",
           "ownerEmail": "<alice>@fixture.test",
-          "rowCount": 0,
+          "rowCount": "<minted>",
           "schema": {
             "columns": [
               {
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
index 8b159a74361..f4a1e41ef64 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
@@ -43,8 +43,11 @@ const ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/
 const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
 /** Fields whose value is minted per write: storage keys and share tokens. */
 const MINTED_FIELDS = new Set(['key', 'token', 'url'])
-/** Ranking scores move with whatever else the shared test database indexed; order is pinned below. */
-const UNSTABLE_SCORES = new Set(['rank', 'rankScore', 'similarity'])
+/**
+ * Ranking scores move with whatever else the shared test database indexed (order is pinned below),
+ * and a table's `rowCount` is maintained by a migration trigger a pushed schema does not install.
+ */
+const UNSTABLE_SCORES = new Set(['rank', 'rankScore', 'similarity', 'rowCount'])
 const MINTED_ID = /\b(?:col|row|tbl)_[0-9a-f]{32}\b/g
 
 /** Replaces values minted per run (ids, times, tokens) so two runs of the same calls compare equal. */
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
index deadfa63b70..2d9caa94749 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
@@ -1,6 +1,7 @@
 import { runEmbeddedCli } from 'sim/embed'
 import { describe, expect, it, vi } from 'vitest'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
+import { markCommittedWriteResponse } from '@/lib/mothership/content-delivery/dispatch'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 
 const endpoint = 'https://sim.test'
@@ -43,6 +44,18 @@ describe('confirmed CLI resource effects', () => {
     expect(await effectsFor(path, 'GET')).toEqual([])
   })
 
+  it('refreshes what a committed write changed even when its result was withheld', async () => {
+    const effects: ResourceChange[] = []
+    const withheld = markCommittedWriteResponse(
+      Response.json({ error: 'The change was saved' }, { status: 403 })
+    )
+    const transport = createResourceEffectTransport(endpoint, async () => withheld, effects)
+    await transport(`${endpoint}/api/v2/tables/t/rows/r`, { method: 'PATCH' })
+    expect(effects).toEqual([{ op: 'upsert', resource: { type: 'table', id: 't' } }])
+    /** A refusal that changed nothing changes nothing. */
+    expect(await effectsFor('tables/t/rows/r', 'PATCH', {}, 403)).toEqual([])
+  })
+
   it.each([
     ['/', 'Report (final).md', 'files/Report%20(final).md'],
     ['/A%2FB/100%25', 'notes.md', 'files/A%2FB/100%25/notes.md'],
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
index b397022a51c..0f758133cd9 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
@@ -15,6 +15,7 @@ import * as secrets from '@/lib/api/contracts/v2/secrets'
 import * as tables from '@/lib/api/contracts/v2/tables'
 import * as workflows from '@/lib/api/contracts/v2/workflows'
 import { parseFolderPath } from '@/lib/folders/paths'
+import { isCommittedWriteResponse } from '@/lib/mothership/content-delivery/dispatch'
 import type { ResourceAddress, ResourceChange } from '@/lib/mothership/generated/resources'
 import { findNonTabFileIds } from '@/lib/mothership/resources/file-tabs'
 import { encodeVfsPathSegments } from '@/lib/vfs/path'
@@ -31,6 +32,8 @@ interface EffectRoute {
   path: string
   readBody?: boolean
   readOnly?: boolean
+  /** Projects from the request alone, so a committed write whose result was withheld still counts. */
+  fromRequest?: boolean
   project: (response: Response, context: EffectContext) => Promise<ResourceChange[]>
 }
 
@@ -99,6 +102,7 @@ function parentAccess(
         method: value.method,
         path: value.path,
         readOnly,
+        fromRequest: true,
         async project(_response: Response, context: EffectContext) {
           /** Literal collection routes also match, preventing /folders from becoming an ID. */
           const id = context.params[parameter]
@@ -389,7 +393,10 @@ export function createResourceEffectTransport(
           : undefined
       : undefined
     const response = await transport(input, init)
-    if (route && response.ok && (!route.readOnly || observeReads)) {
+    const changed =
+      response.ok ||
+      (route?.fromRequest === true && !route.readOnly && isCommittedWriteResponse(response))
+    if (route && changed && (!route.readOnly || observeReads)) {
       const params = matchParams(route.path, url.pathname)
       if (params)
         effects.push(...(await onlyFileTabs(await route.project(response, { params, body }))))
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.ts b/apps/sim/lib/mothership/chat/application/inline-images.ts
index 281b3edc0e5..49bf6fb913e 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.ts
@@ -1,6 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { defineWorkspaceOperation } from '@/lib/core/application'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { admitContent, observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
@@ -111,6 +111,11 @@ export const materializeInlineChatImage = defineAuthorizedChatUseCase({
   },
   async execute({ principal, context, input, request }) {
     validateImageInput(input)
+    /**
+     * The result is a URL. The source read below admits its own bytes; a snapshot already
+     * published was admitted when it was published.
+     */
+    await admitContent(principal, [])
     const signal = input.signal ?? request?.signal
     signal?.throwIfAborted()
     const url = inlineChatImageUrl(context.chatId, input.requestId, input.reference)
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 6694ec63841..88d7c0836bf 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -1,4 +1,5 @@
 import { dbChainMockFns, workflowAuthzMockFns } from '@sim/testing'
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import {
   integrationsAvailabilityMock,
   integrationsAvailabilityMockFns,
@@ -36,6 +37,7 @@ import {
 } from '@sim/testing/mocks/workspace-file-manager.mock'
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
 import { DelegatedWorkspaceAuthorizationError } from '@/lib/core/application'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import {
   MAX_TABLE_SELECTION_PREVIEW_LENGTH,
   MAX_TABLE_SELECTION_ROWS,
@@ -118,6 +120,7 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () =>
   readWorkspaceFileMetadata: { execute: readWorkspaceFileMetadata },
 }))
 vi.mock('@/lib/table/application/rows', () => tableApplicationRowsMock)
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/table/application/views', () => ({
   readTableViewUseCase: { execute: readTableView },
 }))
@@ -1451,6 +1454,47 @@ describe('processContextsServer - table_selection contexts', () => {
     expect(queryTableRows).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['a pipe', 'tok|en-FIXTURE-PIPE-0001'],
+    ['a newline', 'tok\nen-FIXTURE-LINE-0002'],
+  ])('redacts a cell secret holding %s before markdown escaping', async (_case, secret) => {
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => ({
+      decrypted: value.slice('enc:'.length),
+    }))
+    readTableUseCase.mockResolvedValue({
+      table: { name: 'Keys', schema: { columns: [{ id: 'c_key', name: 'Key' }] } },
+      folderPath: '/',
+    })
+    const rows = [{ id: 'r1', data: { c_key: `value ${secret}` } }]
+    /** The real query admits each row it returns; this one carries the secret's provenance. */
+    queryTableRows.mockImplementation(async ({ principal }) => {
+      await admitContent(principal, [
+        {
+          kind: 'table-row',
+          id: 'r1',
+          provenance: {
+            status: 'exact',
+            entries: [
+              { name: 'CELL_TOKEN', encryptedValue: `enc:${secret}`, sourceUserId: 'user-1' },
+            ],
+          },
+          view: { derived: rows[0].data },
+        },
+      ])
+      return { rows, totalCount: 1 }
+    })
+    const [context] = await processContextsServer(
+      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Keys', rowIds: ['r1'] }],
+      'user-1',
+      '',
+      'ws-1'
+    )
+    expect(context.content).toContain('[REDACTED_SECRET]')
+    for (const fragment of [secret.slice(0, 4), secret.slice(-4), ...secret.split(/[|\n]/)]) {
+      expect(context.content).not.toContain(fragment)
+    }
+  })
+
   it('keeps oversized column headings within the selection budget', async () => {
     readTableUseCase.mockResolvedValue({
       table: {
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 2a1dc81c6ef..6b4c0ce94c5 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -1221,12 +1221,27 @@ async function resolveTableSelectionResource(
   // needs. The real clause isn't known until packing finishes, so reserve its
   // longest form: every row shown AND every row omitted maximizes both counts
   // and forces the plural. A few characters of unused slack beats overshooting.
+  /**
+   * Each cell is redacted as stored, before markdown escaping rewrites `|` and newlines: redaction
+   * matches a secret's exact text, so escaping first would let a secret holding either pass.
+   */
+  let cellsProjected = true
+  const projectCell = (value: unknown): string => {
+    if (value === null || value === undefined) return ''
+    const projection = projectResolvedSecretModelContent(
+      typeof value === 'string' ? value : JSON.stringify(value),
+      selectionRegistry
+    )
+    if (projection.safe && typeof projection.value === 'string') return projection.value
+    cellsProjected = false
+    return ''
+  }
   const lines: string[] = []
   let remaining =
     MAX_TABLE_SELECTION_PREVIEW_LENGTH -
     describe(sizeClause(selectedRowCount, selectedRowCount)).length
   for (const row of rows) {
-    const line = `| ${renderTableCell(row.id)} | ${columns.map((col) => renderTableCell(row.data[getColumnId(col)])).join(' | ')} |`
+    const line = `| ${renderTableCell(row.id)} | ${columns.map((col) => renderTableCell(projectCell(row.data[getColumnId(col)]))).join(' | ')} |`
     if (line.length + 1 > remaining) break
     lines.push(line)
     remaining -= line.length + 1
@@ -1240,7 +1255,7 @@ async function resolveTableSelectionResource(
       ? `\n\n${withheldRows} selected ${withheldRows === 1 ? 'row is' : 'rows are'} not shown: ${withheldRows === 1 ? 'its' : 'their'} secret provenance could not be verified.`
       : ''
   const preview =
-    !projected.safe || typeof projected.value !== 'string'
+    !cellsProjected || !projected.safe || typeof projected.value !== 'string'
       ? `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). Cell values could not be checked for secret values, so none were inlined.`
       : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
         ? `${projected.value}${withheldNote}`
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
index 9066d48e716..3ec9dc6d1fb 100644
--- a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
@@ -5,14 +5,17 @@ import type { Principal } from '@sim/auth/principal'
 import { describe, expect, it } from 'vitest'
 import {
   admitContent,
+  admitWrittenContent,
   type ContentDeliveryGate,
   type ContentSource,
   noteContentDeliveryOperation,
+  runDeclaredContentOperation,
 } from '@/lib/core/application/content-delivery'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 import {
   deliveredFileProvenance,
   dispatchUnderContentGate,
+  isCommittedWriteResponse,
 } from '@/lib/mothership/content-delivery/dispatch'
 
 const now = Date.now()
@@ -69,7 +72,28 @@ describe('dispatchUnderContentGate', () => {
         }
         return Response.json({ data: 'unreachable' })
       })
-    ).rejects.toBe(failure)
+    ).rejects.toMatchObject({
+      name: 'ContentGateFailure',
+      gateFailure: failure,
+      committedWrite: false,
+    })
+  })
+
+  it('marks a withheld response to a committed write, so what it changed is still refreshed', async () => {
+    const refusing: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => false)
+      },
+    }
+    const { response } = await dispatchUnderContentGate(refusing, async () => {
+      const outcome = await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await admitWrittenContent(CHAT, [SOURCE])
+        return 'saved'
+      }).catch(() => 'withheld')
+      return Response.json({ error: outcome }, { status: 403 })
+    })
+    expect(response.status).toBe(403)
+    expect(isCommittedWriteResponse(response)).toBe(true)
   })
 
   it('replaces any successful response that never classified its content with a 403', async () => {
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.ts b/apps/sim/lib/mothership/content-delivery/dispatch.ts
index 9ded6bad23e..ef8383d2293 100644
--- a/apps/sim/lib/mothership/content-delivery/dispatch.ts
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.ts
@@ -1,5 +1,6 @@
 import {
   type ContentDeliveryGate,
+  ContentGateFailure,
   type ContentProvenance,
   observeContentDelivery,
   trackContentDelivery,
@@ -14,6 +15,22 @@ import { v2Error } from '@/app/api/v2/lib/response'
 const UNCLASSIFIED_CONTENT_MESSAGE =
   'This result cannot be returned to Chat because its content was not checked for secret values.'
 
+const committedWrites = new WeakSet<Response>()
+
+/**
+ * Whether a refused or failed response answers a write that committed: the change happened even
+ * though its result is withheld, so what it changed still needs refreshing.
+ */
+export function isCommittedWriteResponse(response: Response): boolean {
+  return committedWrites.has(response)
+}
+
+/** Marks a response a transport built itself for a write that committed; see above. */
+export function markCommittedWriteResponse(response: Response): Response {
+  committedWrites.add(response)
+  return response
+}
+
 /**
  * Dispatches one Chat request under `gate`, whatever its method. A successful response from an
  * operation declared to return stored content that never classified it is replaced by a `403`, so
@@ -25,13 +42,14 @@ export async function dispatchUnderContentGate(
   dispatch: () => Promise<Response>
 ): Promise<{ response: Response; admitted: readonly ContentProvenance[] }> {
   const record = await observeContentDelivery(gate, () => trackContentDelivery(dispatch))
+  if (record.committedWrite) committedWrites.add(record.result)
   /**
    * A gate that failed to decide is the transport's to answer, not the route's: the route mapped
    * it to a generic error, and a write it interrupted may already have committed.
    */
   if (record.gateFailure !== undefined) {
     await record.result.body?.cancel().catch(() => {})
-    throw record.gateFailure
+    throw new ContentGateFailure(record.gateFailure, record.committedWrite)
   }
   if (record.unaccounted && record.result.ok) {
     await record.result.body?.cancel().catch(() => {})
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
index 23ee267fa98..404930e3596 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -51,7 +51,6 @@ function modelView(text: string, registry: ResolvedSecretTraceRegistry) {
 }
 
 beforeEach(() => {
-  vi.clearAllMocks()
   encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => {
     const plaintext = value.slice('enc:'.length)
     if (!plaintext) throw new Error('decryption failed')
@@ -134,6 +133,11 @@ describe('createRegistryContentGate', () => {
     expect(modelView('anything at all', registry)).toBeUndefined()
   })
 
+  it('refuses an unknown item under taint when no registry could withhold the output', async () => {
+    const gate = createRegistryContentGate({ actorUserId: 'user-1', unknown: 'taint' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+  })
+
   it('refuses only the item whose secrets cannot be imported, keeping the rest of the call', async () => {
     const registry = newRegistry()
     const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index d20d2ccf724..1d6eee3091c 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -39,8 +39,9 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
   ): Promise<boolean> => {
     const { provenance } = source
     if (provenance.status === 'unknown') {
-      if (scope.unknown !== 'taint') return refuse(source, 'unknown')
-      scope.registry?.markIncomplete('workspace-file-provenance-unknown')
+      /** Taint needs a registry to latch; without one the bytes would reach the model as is. */
+      if (scope.unknown !== 'taint' || !scope.registry) return refuse(source, 'unknown')
+      scope.registry.markIncomplete('workspace-file-provenance-unknown')
       return true
     }
     if (provenance.status === 'unrecorded') {
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
index 022750b45a9..99338ac8fb8 100644
--- a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
@@ -37,7 +37,6 @@ const gate = () =>
   })
 
 beforeEach(() => {
-  vi.clearAllMocks()
   history.recordExistingSessionFileInput.mockResolvedValue(undefined)
 })
 
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index 84956c6116f..d57bba22b13 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -3,12 +3,16 @@ import { generateId } from '@sim/utils/id'
 import { NextRequest } from 'next/server'
 import { markCopilotRequest } from '@/lib/api/server/routes/copilot-request'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { ContentGateFailure } from '@/lib/core/application/content-delivery'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
-import { dispatchUnderContentGate } from '@/lib/mothership/content-delivery/dispatch'
+import {
+  dispatchUnderContentGate,
+  markCommittedWriteResponse,
+} from '@/lib/mothership/content-delivery/dispatch'
 import {
   createSessionContentGate,
   WorkbenchProvenanceUnavailableError,
@@ -126,18 +130,24 @@ async function proxyAuthorizedSandboxRequest(
     try {
       response = (await dispatchUnderContentGate(gate, dispatch)).response
     } catch (error) {
-      if (!(error instanceof WorkbenchProvenanceUnavailableError)) throw error
+      if (
+        !(error instanceof ContentGateFailure) ||
+        !(error.gateFailure instanceof WorkbenchProvenanceUnavailableError)
+      ) {
+        throw error
+      }
       /** A mutation may already have committed; the result is withheld, never retried for it. */
       logger.warn('Sandbox response provenance could not be recorded', {
         toolCallId: scope.toolCallId,
       })
-      response = Response.json(
+      const withheld = Response.json(
         {
           error:
             'The API request ran, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.',
         },
         { status: 502 }
       )
+      response = error.committedWrite ? markCommittedWriteResponse(withheld) : withheld
     }
     return response
   }
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index e4dc935d2bb..ec11238190f 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -694,9 +694,15 @@ async function compileDocInLegacySandbox(
     )
   }
 
+  /** Admitted before the cache too: a cached build may embed a file the gate now refuses. */
+  const readableWorkspaceFileIds = await admitBrokerFiles(args)
   const cacheKey = sha256Hex(`.${fmt.ext}${args.source}${args.workspaceId}`)
   const cached = compiledDocCache.get(cacheKey)
-  if (cached) {
+  /** A build another caller made may have read files this compile may not; it rebuilds instead. */
+  const cacheReadable =
+    !readableWorkspaceFileIds ||
+    (cached?.contributingFiles ?? []).every((file) => readableWorkspaceFileIds.has(file.fileId))
+  if (cached && cacheReadable) {
     return {
       buffer: cached.buffer,
       contentType: fmt.contentType,
@@ -710,7 +716,6 @@ async function compileDocInLegacySandbox(
     }
   }
 
-  const readableWorkspaceFileIds = await admitBrokerFiles(args)
   const contributingFiles = new Map<string, WorkspaceFileSecretProvenanceIdentity>()
   const buffer = await runSandboxTask(
     format.taskId,
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index e7e71d9402a..b6ddcb36be8 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -27,7 +27,11 @@ const {
   mockLoadExecutionsForRow,
   mockLoadEnrichmentDetail,
   mockRowProvenance,
+  mockFindRowMatches,
+  mockClassifyColumns,
 } = vi.hoisted(() => ({
+  mockFindRowMatches: vi.fn(),
+  mockClassifyColumns: vi.fn(),
   mockIsScopeCompatible: vi.fn(),
   mockLoadExecutionsForRow: vi.fn(),
   mockLoadEnrichmentDetail: vi.fn(),
@@ -40,6 +44,7 @@ vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
 vi.mock('@/lib/table', () => ({
   ...tableMock,
+  findRowMatches: mockFindRowMatches,
   TABLE_LIMITS: { ...tableMock.TABLE_LIMITS, MAX_ROW_RUN_STATE_BYTES: 256 },
 }))
 
@@ -52,6 +57,7 @@ vi.mock('@/lib/table/column-types', () => ({
 /** The reader classifies each row on its own; `mockRowProvenance` answers per row id. */
 vi.mock('@/lib/table/rows/secret-provenance', () => ({
   ...tableRowsSecretProvenanceMock,
+  classifyStoredTableRowColumns: mockClassifyColumns,
   TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
     rowProvenance(rowId: string) {
       return mockRowProvenance(rowId)
@@ -64,6 +70,7 @@ vi.mock('@/lib/table/validation', () => ({
 }))
 
 vi.mock('@/lib/execution/durable-secret-provenance', () => ({
+  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE: { status: 'exact', entries: [] },
   isPrivateSecretProvenanceScopeCompatible: mockIsScopeCompatible,
 }))
 
@@ -99,6 +106,7 @@ import {
   readTableRowEnrichmentDetail,
   replaceProjectedWireRows,
   replaceTableRows,
+  searchTableRows,
   TableRowsValidationError,
   updateTableRow,
   updateTableRows,
@@ -1082,4 +1090,43 @@ describe('row delivery to Chat', () => {
       }
     )
   })
+
+  describe('row search for Chat', () => {
+    const MATCHES = [
+      { ordinal: 0, rowId: 'row-a', column: 'col-plain' },
+      { ordinal: 0, rowId: 'row-a', column: 'col-secret' },
+      { ordinal: 1, rowId: 'row-b', column: 'col-plain' },
+    ]
+    const search = (principal: Caller) =>
+      searchTableRows.execute({ principal, input: { tableId: TABLE.id, q: 'needle' } })
+
+    beforeEach(() => {
+      mockClassifyColumns.mockResolvedValue(
+        new Map([
+          ['row-a', { status: 'exact', secretColumns: new Set(['col-secret']) }],
+          ['row-b', { status: 'unknown' }],
+        ])
+      )
+    })
+
+    it('does not signal truncation through a match it withheld', async () => {
+      mockFindRowMatches.mockResolvedValue({ matches: MATCHES, truncated: true })
+      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
+      expect(result.matches).toEqual([MATCHES[0]])
+      expect(result.truncated).toBe(false)
+    })
+
+    it('keeps truncation when every match on a capped page was admitted', async () => {
+      mockFindRowMatches.mockResolvedValue({ matches: [MATCHES[0]], truncated: true })
+      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
+      expect(result).toMatchObject({ matches: [MATCHES[0]], truncated: true })
+    })
+
+    it('answers a person with every match and the raw truncation', async () => {
+      mockFindRowMatches.mockResolvedValue({ matches: MATCHES, truncated: true })
+      const result = await search(PRINCIPAL)
+      expect(result).toMatchObject({ matches: MATCHES, truncated: true })
+      expect(mockClassifyColumns).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index f7ace7a4b2a..897316fb7bb 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -735,10 +735,16 @@ export const searchTableRows = defineAuthorizedTableUseCase({
         { q: input.q, filter, sort },
         requestId(input)
       )
+      const matches = await admitRowMatches(principal, result.matches)
       return {
         table: context.table,
-        ...result,
-        matches: await admitRowMatches(principal, result.matches),
+        matches,
+        /**
+         * A capped search that withheld a match cannot say whether what lies past the cap is
+         * admissible, so truncation is reported only when every match on the page was admitted;
+         * otherwise a refused match would be signalled through the flag alone.
+         */
+        truncated: result.truncated && matches.length === result.matches.length,
       }
     } catch (error) {
       rethrowQueryValidation(error)
diff --git a/apps/sim/lib/table/import-data.ts b/apps/sim/lib/table/import-data.ts
index ab25e7e0ac2..fc5276a6c28 100644
--- a/apps/sim/lib/table/import-data.ts
+++ b/apps/sim/lib/table/import-data.ts
@@ -53,6 +53,8 @@ export interface BulkImportBatch {
   afterOrderKey?: string | null
   /** Provenance each row inherits from its source; absent, rows are exact-empty. */
   rowProvenance?: ImportedRowProvenance
+  /** Each row's cells as the source held them, aligned with `rows`; see `importedRowSources`. */
+  rowSources?: readonly RowData[]
 }
 
 /**
@@ -148,9 +150,11 @@ export async function bulkInsertImportBatch(
       }
     }
     return mutateTableRowsWithSecretProvenance(trx, {
-      rows: rowsToInsert.map((row) => ({
+      rows: rowsToInsert.map((row, index) => ({
         rowId: row.id,
-        provenance: (data.rowProvenance ?? createExactEmptyTableRowSecretProvenance)(row.data),
+        provenance: data.rowProvenance
+          ? data.rowProvenance(row.data, data.rowSources?.[index])
+          : createExactEmptyTableRowSecretProvenance(row.data),
       })),
       rowState: 'new',
       mode: 'replace',
diff --git a/apps/sim/lib/table/import-provenance.test.ts b/apps/sim/lib/table/import-provenance.test.ts
new file mode 100644
index 00000000000..69de5ed771c
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.test.ts
@@ -0,0 +1,91 @@
+/**
+ * @vitest-environment node
+ */
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+
+import { importedRowSources, resolveImportedRowProvenance } from '@/lib/table/import-provenance'
+
+/** Leading zeros a number column drops, so the coerced cell no longer holds the secret's text. */
+const SECRET = '0042424242424242'
+const SOURCE = { workspaceId: 'workspace-1', userId: 'user-1', fileKey: 'imports/file.csv' }
+
+function storeSource(provenance: unknown) {
+  workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+    new Map([[SOURCE.fileKey, provenance]])
+  )
+}
+
+beforeEach(() => {
+  encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => ({
+    decrypted: value.slice('enc:'.length),
+  }))
+  storeSource({
+    status: 'exact',
+    entries: [{ name: 'CARD', encryptedValue: `enc:${SECRET}`, sourceUserId: 'user-1' }],
+  })
+})
+
+describe('resolveImportedRowProvenance', () => {
+  it('gives each cell the secrets its stored text contains', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    const row = { c_card: `card ${SECRET}`, c_note: 'plain' }
+    const written = stamp(row, { ...row })
+    expect(written.complete).toBe(true)
+    expect(written.columns.c_card?.entries).toHaveLength(1)
+    expect(written.columns.c_note?.entries).toEqual([])
+  })
+
+  it('makes a row unknown when coercion rewrote a cell that held a secret', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    /** A number column parses the secret; the stored value no longer matches its text. */
+    const written = stamp({ c_card: Number(SECRET) }, { c_card: SECRET })
+    expect(written.complete).toBe(false)
+  })
+
+  it('keeps a row exact when coercion rewrote only cells without secrets', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    const written = stamp({ c_count: 7, c_empty: null }, { c_count: '7', c_empty: `x ${SECRET}` })
+    expect(written.complete).toBe(true)
+  })
+
+  it.each([
+    ['a clean file', { status: 'exact', entries: [] }],
+    ['an unrecorded file', { status: 'unrecorded' }],
+    ['a key no file names', undefined],
+  ])('keeps rows from %s exact-empty, as before', async (_case, provenance) => {
+    storeSource(provenance)
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    expect(stamp({ c_card: 7 }, { c_card: SECRET })).toEqual({
+      complete: true,
+      columns: { c_card: { version: 1, complete: true, entries: [] } },
+    })
+  })
+
+  it('makes every row from an unknown file unknown', async () => {
+    storeSource({ status: 'unknown' })
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    expect(stamp({ c_note: 'plain' }, { c_note: 'plain' }).complete).toBe(false)
+  })
+})
+
+describe('importedRowSources', () => {
+  it('keys each raw cell by the column id its header maps to', () => {
+    const sources = importedRowSources(
+      [{ Amount: '12.50', Ignored: 'x' }],
+      { columns: [{ id: 'col_amount', name: 'amount', type: 'number' }] },
+      new Map([['Amount', 'amount']])
+    )
+    expect(sources).toEqual([{ col_amount: '12.50' }])
+  })
+})
diff --git a/apps/sim/lib/table/import-provenance.ts b/apps/sim/lib/table/import-provenance.ts
index 0c34f4a37e7..6abaa5445d1 100644
--- a/apps/sim/lib/table/import-provenance.ts
+++ b/apps/sim/lib/table/import-provenance.ts
@@ -1,15 +1,22 @@
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { getColumnId } from '@/lib/table/column-keys'
 import {
   createExactEmptyTableRowSecretProvenance,
   createTableRowSecretProvenanceFromRegistry,
   createUnknownTableRowSecretProvenance,
 } from '@/lib/table/rows/secret-provenance'
-import type { RowData, TableRowSecretProvenanceWrite } from '@/lib/table/types'
+import type { RowData, TableRowSecretProvenanceWrite, TableSchema } from '@/lib/table/types'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
-/** Stamps each imported row with the provenance its cells inherit from the source file. */
-export type ImportedRowProvenance = (row: RowData) => TableRowSecretProvenanceWrite
+/**
+ * Stamps each imported row with the provenance its cells inherit from the source file. `source`
+ * is the row's text as the file held it, keyed by column id, before coercion rewrote any cell.
+ */
+export type ImportedRowProvenance = (
+  row: RowData,
+  source?: RowData
+) => TableRowSecretProvenanceWrite
 
 /**
  * The provenance every row of an import inherits from the stored file it reads, resolved by the
@@ -39,5 +46,40 @@ export async function resolveImportedRowProvenance(source: {
   if (!(await importDurableSecretProvenance(registry, provenance))) {
     return createUnknownTableRowSecretProvenance
   }
-  return (row) => createTableRowSecretProvenanceFromRegistry(row, registry)
+  return (row, source) => {
+    /**
+     * Coercion can rewrite a secret (a number parsed, a date normalized) into text redaction no
+     * longer matches; such a row cannot be vouched for cell by cell, so it is unknown.
+     */
+    for (const [columnId, raw] of Object.entries(source ?? {})) {
+      const stored = row[columnId]
+      if (stored === null || stored === undefined || Object.is(stored, raw)) continue
+      const rawProvenance = registry.exportCommittedProvenanceForValue(raw)
+      if (!rawProvenance.complete || rawProvenance.entries.length > 0) {
+        return createUnknownTableRowSecretProvenance()
+      }
+    }
+    return createTableRowSecretProvenanceFromRegistry(row, registry)
+  }
+}
+
+/**
+ * Each parsed row's cells as the file held them, keyed by the column id coercion writes, aligned
+ * with what `coerceRowsForTable` returns for the same rows.
+ */
+export function importedRowSources(
+  rows: readonly Record<string, unknown>[],
+  schema: TableSchema,
+  headerToColumn: ReadonlyMap<string, string>
+): RowData[] {
+  const columnIdByName = new Map(schema.columns.map((column) => [column.name, getColumnId(column)]))
+  return rows.map((row) => {
+    const source: RowData = {}
+    for (const [header, value] of Object.entries(row)) {
+      const columnName = headerToColumn.get(header)
+      const columnId = columnName === undefined ? undefined : columnIdByName.get(columnName)
+      if (columnId !== undefined) source[columnId] = value as RowData[string]
+    }
+    return source
+  })
 }
diff --git a/apps/sim/lib/table/import-runner.ts b/apps/sim/lib/table/import-runner.ts
index 8f09083452a..dd4efa4fd2d 100644
--- a/apps/sim/lib/table/import-runner.ts
+++ b/apps/sim/lib/table/import-runner.ts
@@ -29,7 +29,7 @@ import {
   deleteAllTableRows,
   setTableSchemaForImport,
 } from '@/lib/table/import-data'
-import { resolveImportedRowProvenance } from '@/lib/table/import-provenance'
+import { importedRowSources, resolveImportedRowProvenance } from '@/lib/table/import-provenance'
 import { createCsvParser } from '@/lib/table/import-stream'
 import {
   markJobFailedInWorkspace,
@@ -324,6 +324,7 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
           startPosition: basePosition + inserted,
           afterOrderKey: lastOrderKey,
           rowProvenance,
+          rowSources: importedRowSources(rows, schema, headerToColumn),
         },
         { ...table, schema },
         requestId,
diff --git a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
index 7a79375ffd7..6d20cbbe9df 100644
--- a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
@@ -24,6 +24,7 @@ import {
   PROVENANCE_MAX_SERIALIZED_BYTES,
 } from '@/lib/execution/provenance-limits'
 import { findWorkspaceFileVersionKeys } from '@/lib/uploads/contexts/workspace/workspace-file-versions'
+import type { OwnedFileContext } from '@/lib/workspace-files/owned-files'
 import { OWNED_FILE_CONTEXTS } from '@/lib/workspace-files/owned-files'
 import {
   isResolvedSecretProvenanceAbsence,
@@ -79,7 +80,8 @@ interface WorkspaceFileAttachmentIdentity {
 export interface WorkspaceFileSecretProvenanceIdentity {
   fileId: string
   key: string
-  context: 'workspace' | 'mothership' | 'execution'
+  /** The row's `context`: a store, or the owner of an owned file (a test or release body). */
+  context: 'workspace' | 'mothership' | 'execution' | OwnedFileContext
   contentUpdatedAt?: Date
 }
 
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
index 140f7b9b392..5b2b080462d 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.test.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -2,18 +2,20 @@
  * @vitest-environment node
  */
 import type { Principal } from '@sim/auth/principal'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const provenance = vi.hoisted(() => ({ getStoredFileSecretProvenanceByKey: vi.fn() }))
 vi.mock(
   '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
-  async (importOriginal) => ({
-    ...(await importOriginal<
-      typeof import('@/lib/uploads/contexts/workspace/workspace-file-secret-provenance')
-    >()),
-    getStoredFileSecretProvenanceByKey: provenance.getStoredFileSecretProvenanceByKey,
-  })
+  () => workspaceFileSecretProvenanceMock
 )
+const provenance = {
+  getStoredFileSecretProvenanceByKey:
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey,
+}
 
 import {
   type ContentDeliveryGate,
@@ -77,7 +79,6 @@ function runFile(name: string, extra: Partial<UserFile> = {}): UserFile {
 }
 
 beforeEach(() => {
-  vi.clearAllMocks()
   provenance.getStoredFileSecretProvenanceByKey.mockImplementation(
     async (_workspaceId: string, keys: readonly string[]) =>
       new Map(keys.filter((key) => STORED.has(key)).map((key) => [key, STORED.get(key)]))
@@ -189,7 +190,7 @@ describe('inlinesRunFiles', () => {
       expect(inlinesRunFiles(CHAT, true, 'stream')).toBe(false)
       expect(inlinesRunFiles(CHAT, true, undefined)).toBe(false)
       expect(inlinesRunFiles(CHAT, true, 'sync')).toBe(true)
-      expect(inlinesRunFiles(CHAT, undefined, 'stream')).toBeUndefined()
+      expect(inlinesRunFiles(CHAT, undefined, 'stream')).toBe(false)
     })
     expect(inlinesRunFiles(EXECUTOR, true, 'stream')).toBe(true)
   })
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
index e2135031ab6..0830a36b7e3 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -5,7 +5,6 @@ import {
   ContentRefusedError,
   type ContentView,
   isCopilotPrincipal,
-  mustClassifyContent,
 } from '@/lib/core/application/content-delivery'
 import { collectUserFilesById, isUserFileWithMetadata } from '@/lib/core/utils/user-file'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -118,5 +117,6 @@ export function inlinesRunFiles(
   requested: boolean | undefined,
   mode: string | undefined
 ): boolean | undefined {
-  return mode !== 'sync' && requested && mustClassifyContent(principal) ? false : requested
+  /** An omitted flag inlines by default downstream, so Chat's streamed runs pin it off. */
+  return mode !== 'sync' && isCopilotPrincipal(principal) ? false : requested
 }
diff --git a/apps/sim/lib/workspace-files/application/admit-file-content.ts b/apps/sim/lib/workspace-files/application/admit-file-content.ts
index e502565d662..575e93f9c0b 100644
--- a/apps/sim/lib/workspace-files/application/admit-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/admit-file-content.ts
@@ -13,15 +13,23 @@ import {
   type WorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenanceIdentity,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { OwnedFileContext, OwnedFileNamespace } from '@/lib/workspace-files/owned-files'
 
 /** What a classification is bound to; a workspace file record satisfies it. */
 interface ClassifiableFile {
   id: string
   key: string
   storageContext?: WorkspaceFileSecretProvenanceIdentity['context']
+  /** An owned file's namespace, which names the owner context its row is stored under. */
+  vfsNamespace?: 'uploads' | OwnedFileNamespace
   contentUpdatedAt?: Date | null
 }
 
+const OWNED_CONTEXT_BY_NAMESPACE = {
+  tests: 'test',
+  changelog: 'changelog',
+} as const satisfies Record<OwnedFileNamespace, OwnedFileContext>
+
 /** The identity a classification is bound to: these exact bytes of this exact canonical file. */
 function workspaceFileProvenanceIdentity(
   file: ClassifiableFile
@@ -29,7 +37,11 @@ function workspaceFileProvenanceIdentity(
   return {
     fileId: file.id,
     key: file.key,
-    context: file.storageContext ?? 'workspace',
+    context:
+      file.storageContext ??
+      (file.vfsNamespace && file.vfsNamespace !== 'uploads'
+        ? OWNED_CONTEXT_BY_NAMESPACE[file.vfsNamespace]
+        : 'workspace'),
     contentUpdatedAt: file.contentUpdatedAt ?? undefined,
   }
 }
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
index 58a2e764342..0140d357053 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
@@ -172,6 +172,39 @@ describe('downloadWorkspaceFileItems', () => {
     expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
   })
 
+  it('counts only the zipped files once a rendered document is left out', async () => {
+    mockListFiles.mockResolvedValue([
+      file('f1', 'clean.txt', null, 10),
+      { ...file('f2', 'report.docx', null, 25), type: 'text/x-generated-document' },
+    ])
+    mockIsGenerated.mockImplementation((type: string) => type === 'text/x-generated-document')
+    mockFetchServable.mockResolvedValue({
+      buffer: Buffer.from('rendered'),
+      contributingFiles: [{ fileId: 'c1', key: 'key-c1', context: 'workspace' }],
+    })
+    mockProvenance.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(
+          identities.map((identity) => [
+            identity.fileId,
+            identity.fileId === 'c1' ? { status: 'unknown' } : { status: 'exact', entries: [] },
+          ])
+        )
+    )
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: createDelegatedPrincipal({
+          subjectUserId: 'u1',
+          workspaceId: 'ws-1',
+          audience: 'sim:workspace-files',
+        }),
+        input: { workspaceId: 'ws-1', fileIds: ['f1', 'f2'], folderIds: [] },
+      })
+    )
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+    expect(result.declaredBytes).toBe(10)
+  })
+
   it('refuses a Chat archive whose every file its gate refuses', async () => {
     mockProvenance.mockResolvedValue(new Map([['f1', { status: 'unknown' }]]))
     await expect(
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index e7a3ecad334..aad852b8a72 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -232,7 +232,13 @@ async function executeDownloadWorkspaceFileItems({
     throw new ContentRefusedError('workspace-file')
   }
 
-  return { filesToZip, folderPaths, renderedDocuments, declaredBytes }
+  return {
+    filesToZip,
+    folderPaths,
+    renderedDocuments,
+    /** Counted over what is zipped, after any rendered document whose contributors were refused. */
+    declaredBytes: filesToZip.reduce((sum, file) => sum + file.size, 0),
+  }
 }
 
 async function resolveDownloadContext({ input }: { input: DownloadWorkspaceFileItemsInput }) {
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
index cd7bce659e8..84550a9e079 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
@@ -4,12 +4,25 @@ import {
   workspaceFileManagerMock,
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
 vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => workspaceFileManagerMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 
+import {
+  type ContentDeliveryGate,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   downloadWorkspaceFileRecord,
   readWorkspaceFileContentRecord,
@@ -88,4 +101,38 @@ describe('workspace file record reads', () => {
     ).rejects.toThrow()
     expect(mocks.getFile).not.toHaveBeenCalled()
   })
+
+  it('binds an owned file to the owner context its row is stored under', async () => {
+    const owned = {
+      ...file,
+      key: 'workspace/workspace-1/test-body.js',
+      vfsNamespace: 'tests' as const,
+      contentUpdatedAt: new Date('2026-01-01T00:00:00.000Z'),
+    }
+    mocks.getFile.mockResolvedValue(owned)
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance.mockResolvedValue(
+      {
+        status: 'exact',
+        entries: [],
+      }
+    )
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    await observeContentDelivery(admitAll, () =>
+      readWorkspaceFileContentRecord.execute({
+        principal: createCopilotChatFilePrincipal({
+          userId: 'user-1',
+          workspaceId: 'workspace-1',
+          chatId: 'chat-1',
+        }),
+        input: { fileId: 'file-1', assertedWorkspaceId: 'workspace-1' },
+      })
+    )
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance
+    ).toHaveBeenCalledWith('workspace-1', expect.objectContaining({ context: 'test' }))
+  })
 })
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
index 96a9cf85eb7..0370f821797 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
@@ -1,5 +1,9 @@
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import {
   workspaceUploadsMock,
   workspaceUploadsMockFns,
@@ -15,11 +19,23 @@ vi.mock('@/lib/uploads/contexts/workspace', () => workspaceUploadsMock)
 vi.mock('@/lib/workspace-files/search/repository', () => ({
   searchWorkspaceFileIndex: hoisted.search,
 }))
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 vi.mock('@/lib/workspace-files/resolve-folder-scope', () => ({
   resolveWorkspaceFolderScope: hoisted.folders,
 }))
 
+import {
+  type ContentDeliveryGate,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { searchWorkspaceFileContent } from '@/lib/workspace-files/application/search-workspace-file-content'
+import { FILE_SEARCH_MAX_RESULTS } from '@/lib/workspace-files/search/constants'
 
 const mocks = {
   load: workspaceUploadsMockFns.mockLoadActiveWorkspaceContext,
@@ -60,3 +76,124 @@ describe('searchWorkspaceFileContent cancellation', () => {
     expect(mocks.search).not.toHaveBeenCalled()
   })
 })
+
+/** Admits clean files only, as Chat's gate does for a match oracle (an opaque view). */
+const cleanOnlyGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) => provenance.status === 'exact' && provenance.entries.length === 0
+    )
+  },
+}
+
+function copilotPrincipal() {
+  const copilot = createCopilotChatPrincipal(
+    { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
+    WORKSPACE_FILES_DELEGATION_AUDIENCE
+  )
+  markCopilotWorkspaceInvocation(copilot)
+  return copilot
+}
+
+function source(fileId: string) {
+  return { identity: { fileId, key: `key-${fileId}`, context: 'workspace' as const } }
+}
+
+function hit(fileId: string, lineNumber: number) {
+  return { fileId, lineNumber, text: `needle ${lineNumber}` }
+}
+
+describe('searchWorkspaceFileContent for Chat', () => {
+  beforeEach(() => {
+    mocks.load.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'user-1',
+    })
+    mocks.permission.mockResolvedValue('read')
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(
+          identities.map((identity) => [
+            identity.fileId,
+            identity.fileId === 'refused'
+              ? { status: 'unknown' }
+              : { status: 'exact', entries: [] },
+          ])
+        )
+    )
+  })
+
+  it('keeps refused matches from taking the place of admitted ones', async () => {
+    mocks.search.mockResolvedValue({
+      results: [hit('refused', 1), hit('refused', 2), hit('clean', 3), hit('clean', 4)],
+      count: 4,
+      truncated: false,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused'), source('clean')],
+    })
+    const found = await observeContentDelivery(cleanOnlyGate, () =>
+      searchWorkspaceFileContent.execute({
+        principal: copilotPrincipal(),
+        input: { ...input, maxResults: 2 },
+      })
+    )
+    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(FILE_SEARCH_MAX_RESULTS)
+    expect(found.results.map((result) => result.lineNumber)).toEqual([3, 4])
+    expect(found).toMatchObject({ count: 2, truncated: false })
+    expect(found.sources.map((entry) => entry.identity.fileId)).toEqual(['clean'])
+  })
+
+  it('does not signal more matches when only refused files matched', async () => {
+    mocks.search.mockResolvedValue({
+      results: [hit('refused', 1)],
+      count: 1,
+      truncated: true,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused')],
+    })
+    const found = await observeContentDelivery(cleanOnlyGate, () =>
+      searchWorkspaceFileContent.execute({
+        principal: copilotPrincipal(),
+        input: { ...input, maxResults: 1 },
+      })
+    )
+    expect(found).toMatchObject({ results: [], count: 0, truncated: false })
+  })
+
+  it("reports truncation from admitted matches past the caller's limit", async () => {
+    mocks.search.mockResolvedValue({
+      results: [hit('clean', 1), hit('clean', 2), hit('clean', 3)],
+      count: 3,
+      truncated: false,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('clean')],
+    })
+    const found = await observeContentDelivery(cleanOnlyGate, () =>
+      searchWorkspaceFileContent.execute({
+        principal: copilotPrincipal(),
+        input: { ...input, maxResults: 2 },
+      })
+    )
+    expect(found).toMatchObject({ count: 2, truncated: true })
+  })
+
+  it("leaves a person's search limit and result untouched", async () => {
+    const raw = {
+      results: [hit('refused', 1)],
+      count: 1,
+      truncated: true,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused')],
+    }
+    mocks.search.mockResolvedValue(raw)
+    const found = await searchWorkspaceFileContent.execute({ principal, input })
+    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(input.maxResults)
+    expect(found).toBe(raw)
+  })
+})
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index b9c91fa8eab..872b120bb1a 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -1,9 +1,11 @@
+import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { loadActiveWorkspaceContext } from '@/lib/uploads/contexts/workspace'
 import { admitWorkspaceFileIdentities } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveWorkspaceFolderScope } from '@/lib/workspace-files/resolve-folder-scope'
+import { FILE_SEARCH_MAX_RESULTS } from '@/lib/workspace-files/search/constants'
 import { WorkspaceFileSearchUnavailableError } from '@/lib/workspace-files/search/errors'
 import {
   compileFileSearchPattern,
@@ -62,10 +64,15 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     signal?.throwIfAborted()
 
     try {
+      /**
+       * Chat drops matches from files it may not read, so it fetches the most the index returns
+       * and keeps its own limit afterwards: refused matches never take an admitted match's place.
+       */
+      const classified = isCopilotPrincipal(principal)
       const found = await searchWorkspaceFileIndex({
         workspaceId: context.workspaceId,
         pattern: compileFileSearchPattern(input.query, input.mode),
-        maxResults: input.maxResults,
+        maxResults: classified ? FILE_SEARCH_MAX_RESULTS : input.maxResults,
         folderScope,
         signal,
       })
@@ -80,12 +87,20 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
         found.sources.map((source) => source.identity),
         'opaque'
       )
-      if (admitted.size === found.sources.length) return found
-      const results = found.results.filter((result) => admitted.has(result.fileId))
+      if (!classified) return found
+      const matches = found.results.filter((result) => admitted.has(result.fileId))
+      const results = matches.slice(0, input.maxResults)
       return {
         ...found,
         results,
         count: results.length,
+        /**
+         * Derived from admitted matches only, so a refused match is never signalled. Matches past
+         * the index's own cap are unknown; they are reported only when this page is full anyway.
+         */
+        truncated:
+          matches.length > input.maxResults ||
+          (found.truncated && matches.length >= input.maxResults),
         sources: found.sources.filter((source) => admitted.has(source.identity.fileId)),
       }
     } catch (error) {

From bbec64263cc31e46ecdc95cacb8c4b53ad95c7f5 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 12 Oct 2026 15:11:58 -0700
Subject: [PATCH 04/13] fix(mothership): close sharing, line-window and
 snapshot gaps in content delivery

Chat may share or see links only to clean files whatever the surface, text
is redacted before a line window cuts it, accounting follows a decision,
cached compiles and knowledge metadata bind to the versions they show,
row-search matches classify at their matched revision, and table counts
follow admitted rows.
---
 .claude/rules/sim-content-delivery.md         | 10 +-
 .cursor/rules/sim-content-delivery.mdc        | 10 +-
 .../core/application/content-delivery.test.ts | 15 +++
 .../lib/core/application/content-delivery.ts  | 29 +++++-
 .../application/admit-knowledge-content.ts    | 18 +++-
 .../lib/knowledge/application/chunks.test.ts  | 37 +++++++-
 apps/sim/lib/knowledge/application/chunks.ts  | 13 ++-
 .../lib/knowledge/application/tags.test.ts    | 25 +++++
 apps/sim/lib/knowledge/application/tags.ts    |  8 +-
 .../lib/knowledge/secret-provenance.test.ts   | 49 ++++++++++
 apps/sim/lib/knowledge/secret-provenance.ts   | 77 +++++++++++++++-
 .../content-delivery-compat.baseline.json     |  8 +-
 .../content-delivery-compat.integration.ts    | 21 ++++-
 .../agent-cli/engines/observe-private-file.ts | 11 ++-
 .../agent-cli/file-provenance.test.ts         |  2 +-
 .../agent-cli/file-read-transport.ts          |  2 +-
 .../agent-cli/resource-effects.test.ts        |  2 +-
 .../mothership/agent-cli/resource-effects.ts  |  2 +-
 .../sim/lib/mothership/agent-cli/transport.ts |  4 +-
 .../chat/application/inline-images.ts         |  2 +-
 .../application/read-sandbox-file.test.ts     |  2 +-
 .../mothership/chat/process-contents.test.ts  | 22 ++++-
 .../lib/mothership/chat/process-contents.ts   | 35 ++++---
 .../lib/mothership/content-delivery/index.ts  |  8 ++
 .../content-delivery/registry-gate.test.ts    | 31 ++++++-
 .../content-delivery/registry-gate.ts         | 12 +++
 .../lib/mothership/tool-executor/executor.ts  |  2 +-
 .../function-execute-file-mounts.test.ts      |  2 +-
 .../tools/handlers/function-execute.ts        |  2 +-
 .../tools/sandbox-resource-transport.ts       |  6 +-
 .../tools/server/files/doc-compile.test.ts    | 83 +++++++++++++++++
 .../tools/server/files/doc-compile.ts         | 41 ++++++---
 apps/sim/lib/table/application/rows.test.ts   | 91 ++++++++++++++++++-
 apps/sim/lib/table/application/rows.ts        | 41 ++++++++-
 .../lib/table/rows/secret-provenance.test.ts  | 44 +++++++++
 apps/sim/lib/table/rows/secret-provenance.ts  | 56 +++++++++++-
 apps/sim/lib/table/rows/service.ts            | 23 ++++-
 .../application/admit-run-files.test.ts       | 11 +++
 .../workflows/application/admit-run-files.ts  |  8 +-
 .../application/read-workspace-file-text.ts   |  4 +-
 .../application/share-workspace-file.test.ts  | 49 +++++++---
 .../application/share-workspace-file.ts       | 39 ++++----
 42 files changed, 841 insertions(+), 116 deletions(-)
 create mode 100644 apps/sim/lib/mothership/content-delivery/index.ts

diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
index becfa8f8efd..020f887bff7 100644
--- a/.claude/rules/sim-content-delivery.md
+++ b/.claude/rules/sim-content-delivery.md
@@ -38,8 +38,10 @@ the workflow executor see byte-identical results.
     redaction reaches: binary, base64, archives, images, public links).
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
-  them into the workbench history. Neither ever admits `unknown`, and one refused item never
-  latches the shared registry.
+  them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
+  single-file download (`files get`) admits it under `unknown: 'taint'`, which latches the call's
+  registry so the whole output is withheld and the workbench copy stays unknown. It needs a
+  registry to latch; without one it refuses. One refused item never latches the shared registry.
 - `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
   the model (the user's own edit preview; a derived file that carries its sources' provenance).
   Name why at each use.
@@ -73,7 +75,7 @@ own unless noted.
 | Bulk download zip | Left out | Left out (opaque) | Included |
 | `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
 | File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
-| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
 | Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
 | Doc compile | Compile refused | Error text redacted | Compiles |
 | Run file download | 403 | Redacted | Delivered |
@@ -82,5 +84,5 @@ own unless noted.
 | KB export, table export download | Not available to Chat | | |
 | Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
 | Row search | Match dropped | Match in a secret column dropped | Returned |
-| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
 | `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
index b1bf6e7aa12..df08f58f731 100644
--- a/.cursor/rules/sim-content-delivery.mdc
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -29,8 +29,10 @@ the workflow executor see byte-identical results.
     redaction reaches: binary, base64, archives, images, public links).
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
-  them into the workbench history. Neither ever admits `unknown`, and one refused item never
-  latches the shared registry.
+  them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
+  single-file download (`files get`) admits it under `unknown: 'taint'`, which latches the call's
+  registry so the whole output is withheld and the workbench copy stays unknown. It needs a
+  registry to latch; without one it refuses. One refused item never latches the shared registry.
 - `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
   the model (the user's own edit preview; a derived file that carries its sources' provenance).
   Name why at each use.
@@ -64,7 +66,7 @@ own unless noted.
 | Bulk download zip | Left out | Left out (opaque) | Included |
 | `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
 | File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
-| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
 | Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
 | Doc compile | Compile refused | Error text redacted | Compiles |
 | Run file download | 403 | Redacted | Delivered |
@@ -73,5 +75,5 @@ own unless noted.
 | KB export, table export download | Not available to Chat | | |
 | Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
 | Row search | Match dropped | Match in a secret column dropped | Returned |
-| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
 | `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
diff --git a/apps/sim/lib/core/application/content-delivery.test.ts b/apps/sim/lib/core/application/content-delivery.test.ts
index 46bd4890c98..405909b7936 100644
--- a/apps/sim/lib/core/application/content-delivery.test.ts
+++ b/apps/sim/lib/core/application/content-delivery.test.ts
@@ -246,6 +246,21 @@ describe('runDeclaredContentOperation', () => {
     expect(record.gateFailure).toBe(failure)
   })
 
+  it('does not account for a result whose admission failed and was caught', async () => {
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw new Error('gate down')
+      },
+    }
+    const outcome = await observeContentDelivery(failing, () =>
+      runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await admitContent(CHAT, [source('read')]).catch(() => undefined)
+        return 'content returned anyway'
+      }).catch((error: unknown) => error)
+    )
+    expect(outcome).toBeInstanceOf(ContentDeliveryUnaccountedError)
+  })
+
   it('does not let a nested use case account for what its enclosing operation returns', async () => {
     const admitAll: ContentDeliveryGate = {
       async admit(sources) {
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
index 4d2698c71a6..1de71334c95 100644
--- a/apps/sim/lib/core/application/content-delivery.ts
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -40,6 +40,11 @@ export interface ContentSource {
  */
 export interface ContentDeliveryGate {
   admit(sources: readonly ContentSource[]): Promise<readonly boolean[]>
+  /**
+   * The text as this surface's egress will show it, or `undefined` when it cannot be shown. A gate
+   * whose surface redacts (Chat's registry) implements it; see {@link redactBeforeCutting}.
+   */
+  project?(text: string): string | undefined
 }
 
 /**
@@ -135,6 +140,24 @@ export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: ()
   return gates.run(gate, execute)
 }
 
+/**
+ * Text a use case is about to cut (a line window, a clip), redacted first by the surface's gate.
+ * Egress redacts whole secrets only, so a cut through one would leave a fragment it cannot
+ * recognize. Other callers, and surfaces that do not redact, get the text unchanged.
+ */
+export function redactBeforeCutting(
+  principal: Principal | undefined,
+  text: string,
+  kind: ContentSourceKind
+): string {
+  if (principal && !isCopilotPrincipal(principal)) return text
+  const project = gates.getStore()?.project
+  if (!project) return text
+  const projected = project(text)
+  if (projected === undefined) throw new ContentRefusedError(kind)
+  return projected
+}
+
 /** Admits every item: see {@link observeContentOutsideModel}. */
 const OUTSIDE_MODEL_GATE: ContentDeliveryGate = {
   async admit(sources) {
@@ -222,8 +245,9 @@ export async function admitContent(
   ) {
     throw new ContentDeliveryUndeclaredError()
   }
-  markAccounted()
+  /** Accounting follows a decision: a caller that catches a failure has classified nothing. */
   if (sources.length === 0 || !mustClassifyContent(principal)) {
+    markAccounted()
     return new ContentAdmission(
       sources,
       sources.map(() => true)
@@ -242,6 +266,7 @@ export async function admitContent(
     }
     throw error
   }
+  markAccounted()
   if (ledger) {
     sources.forEach((source, index) => {
       if (verdicts[index]) {
@@ -274,6 +299,8 @@ export async function admitWrittenContent(
      */
     const [first] = sources
     if (!ledgers.getStore() || !first) throw error
+    /** The result is decided after all: withheld whole, as saved-not-shown. */
+    markAccounted()
     withholdAfterWrite(first.kind)
     return new ContentAdmission(
       sources,
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
index d4386423f81..51f76471c68 100644
--- a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -3,6 +3,8 @@ import { admitEach, type ContentSourceKind } from '@/lib/core/application/conten
 import {
   classifyKnowledgeChunks,
   classifyKnowledgeDocumentMetadata,
+  type KnowledgeDocumentSnapshot,
+  knowledgeDocumentSnapshot,
 } from '@/lib/knowledge/secret-provenance'
 
 interface KnowledgeAdmissionOptions {
@@ -16,18 +18,28 @@ const writtenAs = (options: KnowledgeAdmissionOptions, kind: ContentSourceKind)
 /**
  * Admits each document whose rendered metadata a result returns, on its own, and returns the ids
  * admitted. `value` is what the result shows of the document, so only secrets it contains are
- * imported. A caller no gate observes gets every id back without a provenance read.
+ * imported; `snapshot` names the stored fields it shows, when they are not its own keys. A caller
+ * no gate observes gets every id back without a provenance read.
  */
 export async function admitKnowledgeDocuments(
   principal: Principal,
-  documents: readonly { id: string; value: unknown }[],
+  documents: readonly { id: string; value: unknown; snapshot?: KnowledgeDocumentSnapshot }[],
   options: KnowledgeAdmissionOptions = {}
 ): Promise<Set<string>> {
   const admitted = await admitEach(
     principal,
     documents,
     async (items) => {
-      const provenance = await classifyKnowledgeDocumentMetadata(items.map((item) => item.id))
+      /** Each classification is bound to the metadata the item shows; see the classifier. */
+      const snapshots = new Map<string, KnowledgeDocumentSnapshot[]>()
+      for (const item of items) {
+        const snapshot = item.snapshot ?? knowledgeDocumentSnapshot(item.value)
+        if (snapshot) snapshots.set(item.id, [...(snapshots.get(item.id) ?? []), snapshot])
+      }
+      const provenance = await classifyKnowledgeDocumentMetadata(
+        items.map((item) => item.id),
+        snapshots
+      )
       return items.map((item) => ({
         kind: 'knowledge-document' as const,
         id: item.id,
diff --git a/apps/sim/lib/knowledge/application/chunks.test.ts b/apps/sim/lib/knowledge/application/chunks.test.ts
index 0a23a8088a4..e1bc7198b61 100644
--- a/apps/sim/lib/knowledge/application/chunks.test.ts
+++ b/apps/sim/lib/knowledge/application/chunks.test.ts
@@ -49,7 +49,11 @@ import { admitContent } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
-import { bulkUpdateKnowledgeChunks, listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import {
+  bulkUpdateKnowledgeChunks,
+  createKnowledgeChunk,
+  listKnowledgeChunks,
+} from '@/lib/knowledge/application/chunks'
 
 describe('knowledge chunk application use cases', () => {
   beforeEach(() => {
@@ -75,6 +79,37 @@ describe('knowledge chunk application use cases', () => {
     })
   }
 
+  it('admits a created chunk with the document name its response shows', async () => {
+    workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('write')
+    knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'billing-owner-1',
+      access: { get: async () => WORKSPACE_ACCESS_SCOPE },
+      knowledgeBaseId: 'knowledge-1',
+      knowledgeBase: { id: 'knowledge-1', embeddingModel: 'text-embedding-3-small' },
+      documentId: 'document-1',
+      document: { id: 'document-1', processingStatus: 'completed', filename: 'named.txt' },
+    })
+    mocks.createChunk.mockResolvedValue({ id: 'chunk-new', content: 'body', tokenCount: 1 })
+    admitOnly(['chunk-new'])
+
+    const result = await createKnowledgeChunk.execute({
+      principal: createSessionPrincipal(),
+      input: {
+        knowledgeBaseId: 'knowledge-1',
+        documentId: 'document-1',
+        content: 'body',
+        resolveContentProvenance: () => undefined,
+      },
+    })
+
+    expect(result.chunk.documentName).toBe('named.txt')
+    const [, [item]] = mocks.admitKnowledgeChunks.mock.calls[0]
+    expect(item.value).toMatchObject({ documentId: 'document-1', documentName: 'named.txt' })
+  })
+
   describe('a searched chunk listing', () => {
     const page = {
       chunks: [
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index de58204d7bb..2946faef16d 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -75,12 +75,14 @@ async function requireAdmittedChunk(
   principal: Principal,
   documentId: string,
   chunk: { id: string; content: string },
-  options: { written?: boolean } = {}
+  options: { written?: boolean; shown?: Record<string, unknown> } = {}
 ): Promise<void> {
+  /** `shown` is every other field the response adds beside the chunk, such as its document name. */
+  const value = options.shown ? { ...chunk, ...options.shown } : chunk
   const admitted = await admitKnowledgeChunks(
     principal,
-    [{ id: chunk.id, documentId, content: chunk.content, value: chunk }],
-    options
+    [{ id: chunk.id, documentId, content: chunk.content, value }],
+    { written: options.written }
   )
   if (!options.written && !admitted.has(chunk.id)) throw new ContentRefusedError('knowledge-chunk')
 }
@@ -239,7 +241,10 @@ export const createKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
     } catch (error) {
       logger.warn('Failed to calculate cost for chunk upload', { error })
     }
-    await requireAdmittedChunk(principal, context.documentId, chunk, { written: true })
+    await requireAdmittedChunk(principal, context.documentId, chunk, {
+      written: true,
+      shown: { documentId: context.documentId, documentName: context.document.filename },
+    })
     return {
       chunk: {
         ...chunk,
diff --git a/apps/sim/lib/knowledge/application/tags.test.ts b/apps/sim/lib/knowledge/application/tags.test.ts
index 4d142216b1d..3c0bc2503dd 100644
--- a/apps/sim/lib/knowledge/application/tags.test.ts
+++ b/apps/sim/lib/knowledge/application/tags.test.ts
@@ -396,6 +396,31 @@ describe('knowledge tag application use cases', () => {
       )
     })
 
+    it('answers Chat an empty usage for a base with no tag definitions', async () => {
+      mocks.readDetailedUsage.mockResolvedValue([])
+      await expect(
+        readDetailedKnowledgeTagUsage.execute({
+          principal: chat,
+          input: { knowledgeBaseId: 'knowledge-b' },
+        })
+      ).resolves.toMatchObject({ usage: [] })
+      expect(admission.admitKnowledgeDocuments).not.toHaveBeenCalled()
+    })
+
+    it('binds each occurrence to the stored tag value it shows', async () => {
+      await readDetailedKnowledgeTagUsage.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+      const [, documents] = admission.admitKnowledgeDocuments.mock.calls[1]
+      expect(documents).toEqual([
+        expect.objectContaining({
+          id: 'doc-shared',
+          snapshot: { filename: 'shared.csv', tag2: 'ops' },
+        }),
+      ])
+    })
+
     it('decides each (definition, document) occurrence on its own', async () => {
       const result = await readDetailedKnowledgeTagUsage.execute({
         principal: chat,
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index 107d4a0c378..90958d6a418 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -363,11 +363,17 @@ async function admitTagUsage(
   principal: Principal,
   usage: Awaited<ReturnType<typeof getTagUsage>>
 ): Promise<Awaited<ReturnType<typeof getTagUsage>>> {
+  /** A base with no tag definitions returns nothing, which is still an accounting. */
+  if (usage.length === 0) await admitContent(principal, [])
   const admitted = []
   for (const definition of usage) {
     const ids = await admitKnowledgeDocuments(
       principal,
-      definition.documents.map((doc) => ({ id: doc.id, value: doc }))
+      definition.documents.map((doc) => ({
+        id: doc.id,
+        value: doc,
+        snapshot: { filename: doc.name, [definition.tagSlot]: doc.tagValue },
+      }))
     )
     const documents = definition.documents.filter((doc) => ids.has(doc.id))
     admitted.push(
diff --git a/apps/sim/lib/knowledge/secret-provenance.test.ts b/apps/sim/lib/knowledge/secret-provenance.test.ts
index b16e7edecd2..0c8c3a37b62 100644
--- a/apps/sim/lib/knowledge/secret-provenance.test.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.test.ts
@@ -5,9 +5,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DbTransaction } from '@/lib/db/types'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
+  classifyKnowledgeDocumentMetadata,
   createKnowledgeDocumentSourceValue,
   importKnowledgePersistedResponseSecretProvenance,
   importKnowledgeSearchResultSecretProvenance,
+  knowledgeDocumentSnapshot,
   loadKnowledgeDocumentSecretRegistry,
   replaceKnowledgeDocumentSecretProvenanceInTx,
 } from '@/lib/knowledge/secret-provenance'
@@ -167,3 +169,50 @@ describe('knowledge durable provenance enforcement', () => {
     expect(registry.isPermanentlyIncomplete()).toBe(true)
   })
 })
+
+describe('document metadata classification bound to the shown snapshot', () => {
+  const NUMBERED_ROW = { ...DOCUMENT_ROW, tag1: 'emea', number1: 42 }
+
+  beforeEach(() => {
+    resetDbChainMock()
+  })
+
+  it('keeps the stored classification while the shown metadata is what is stored', async () => {
+    queueTableRows(document, [NUMBERED_ROW])
+    const result = await classifyKnowledgeDocumentMetadata(
+      [NUMBERED_ROW.id],
+      new Map([[NUMBERED_ROW.id, [{ filename: 'source.pdf', tag1: 'emea', number1: '42' }]]])
+    )
+    expect(result.get(NUMBERED_ROW.id)?.status).toBe('exact')
+  })
+
+  it.each([
+    ['a renamed document', { filename: 'previous-name.pdf' }],
+    ['an edited tag', { tag1: 'previous value' }],
+    ['a tag cleared since', { tag2: 'previous value' }],
+    ['an edited number', { number1: '7' }],
+  ])(
+    'reads %s as unknown, so stale values are not paired with new provenance',
+    async (_, shown) => {
+      queueTableRows(document, [NUMBERED_ROW])
+      const result = await classifyKnowledgeDocumentMetadata(
+        [NUMBERED_ROW.id],
+        new Map([[NUMBERED_ROW.id, [shown]]])
+      )
+      expect(result.get(NUMBERED_ROW.id)).toEqual({ status: 'unknown' })
+    }
+  )
+
+  it('picks only the editable metadata a returned value shows', () => {
+    expect(
+      knowledgeDocumentSnapshot({
+        id: 'd',
+        filename: 'f.pdf',
+        tag3: 'x',
+        fileUrl: '/u',
+        date1: 'd',
+      })
+    ).toEqual({ filename: 'f.pdf', tag3: 'x' })
+    expect(knowledgeDocumentSnapshot({ id: 'd', fileUrl: '/u' })).toBeUndefined()
+  })
+})
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index 7dff04b3001..89e575464f2 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -444,8 +444,68 @@ export async function loadKnowledgeDocumentSecretRegistry(
  * statement for all of them. A document that is gone, or whose binding no longer matches its row,
  * reads as unknown.
  */
+/**
+ * Metadata fields a person can edit in place that can hold text, which a returned snapshot is
+ * checked against. Date and boolean slots are typed columns no secret text can occupy.
+ */
+const EDITABLE_DOCUMENT_FIELDS = [
+  'filename',
+  'tag1',
+  'tag2',
+  'tag3',
+  'tag4',
+  'tag5',
+  'tag6',
+  'tag7',
+  'number1',
+  'number2',
+  'number3',
+  'number4',
+  'number5',
+] as const satisfies readonly (keyof KnowledgeDocumentSourceValue)[]
+
+/** What a result shows of a document's metadata by stored field name, to bind its class to. */
+export type KnowledgeDocumentSnapshot = Readonly<Record<string, unknown>>
+
+const isEditableField = (field: string): boolean =>
+  (EDITABLE_DOCUMENT_FIELDS as readonly string[]).includes(field)
+
+function comparableField(value: unknown): string | null {
+  if (value === null || value === undefined || value === '') return null
+  return String(value)
+}
+
+/** A number slot is compared by value, since its text form can differ from its stored form. */
+function sameField(stored: unknown, shown: unknown): boolean {
+  const left = comparableField(stored)
+  const right = comparableField(shown)
+  if (left === right) return true
+  if (left === null || right === null) return false
+  return typeof stored === 'number' && Number(right) === stored
+}
+
+/** Picks the editable metadata a returned value shows, when it shows any. */
+export function knowledgeDocumentSnapshot(value: unknown): KnowledgeDocumentSnapshot | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined
+  const snapshot: Record<string, unknown> = {}
+  let shown = false
+  for (const field of EDITABLE_DOCUMENT_FIELDS) {
+    if (Object.hasOwn(value, field)) {
+      snapshot[field] = Reflect.get(value, field)
+      shown = true
+    }
+  }
+  return shown ? snapshot : undefined
+}
+
+/**
+ * Classifies the rendered metadata of each document. A document whose stored metadata no longer
+ * matches a snapshot the result shows reads as unknown: a concurrent edit must not pair the old
+ * values, which the result still carries, with the new row's classification.
+ */
 export async function classifyKnowledgeDocumentMetadata(
-  documentIds: readonly string[]
+  documentIds: readonly string[],
+  snapshots?: ReadonlyMap<string, readonly KnowledgeDocumentSnapshot[]>
 ): Promise<Map<string, DurableSecretProvenance>> {
   const ids = [...new Set(documentIds)]
   const rows = ids.length
@@ -454,12 +514,19 @@ export async function classifyKnowledgeDocumentMetadata(
   const result = new Map<string, DurableSecretProvenance>()
   for (const row of rows) {
     const source = createKnowledgeDocumentSourceValue(row)
+    const stale = (snapshots?.get(row.id) ?? []).some((snapshot) =>
+      Object.entries(snapshot).some(
+        ([field, shown]) => isEditableField(field) && !sameField(Reflect.get(source, field), shown)
+      )
+    )
     result.set(
       row.id,
-      filterKnowledgeDocumentMetadataSecretProvenance(
-        readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
-        source
-      )
+      stale
+        ? { status: 'unknown' }
+        : filterKnowledgeDocumentMetadataSecretProvenance(
+            readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
+            source
+          )
     )
   }
   for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
index 86688907e65..2f85e7c1452 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
@@ -329,7 +329,7 @@
         "resourceId": "<file:unknown>",
         "resourceType": "file",
         "token": "<minted>",
-        "url": "<minted>"
+        "url": "http://localhost:3000/f/<minted>"
       }
     }
   },
@@ -827,7 +827,7 @@
             "name": "clean.txt",
             "size": 50,
             "type": "text/plain",
-            "url": "<minted>"
+            "url": "http://localhost:3000/api/files/serve/<minted>"
           },
           "entries": {
             "context": "execution",
@@ -836,7 +836,7 @@
             "name": "entries.txt",
             "size": 64,
             "type": "text/plain",
-            "url": "<minted>"
+            "url": "http://localhost:3000/api/files/serve/<minted>"
           },
           "unknown": {
             "context": "execution",
@@ -845,7 +845,7 @@
             "name": "unknown.txt",
             "size": 56,
             "type": "text/plain",
-            "url": "<minted>"
+            "url": "http://localhost:3000/api/files/serve/<minted>"
           }
         },
         "paused": null,
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
index f4a1e41ef64..56bb32a31f5 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
@@ -42,7 +42,22 @@ import {
 const ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/
 const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
 /** Fields whose value is minted per write: storage keys and share tokens. */
-const MINTED_FIELDS = new Set(['key', 'token', 'url'])
+const MINTED_FIELDS = new Set(['key', 'token'])
+
+/**
+ * A URL keeps its origin and fixed path, so a wrong host or route still fails; only the segments
+ * a write minted (tokens, storage keys: anything but lowercase words) and query values vary.
+ */
+function normalizeUrl(value: string, labels: Map<string, string>): string {
+  if (!URL.canParse(value)) return String(normalize(value, labels))
+  const url = new URL(value)
+  const path = url.pathname
+    .split('/')
+    .map((segment) => (/^[a-z-]*$/.test(segment) ? segment : '<minted>'))
+    .join('/')
+  const query = [...url.searchParams.keys()].sort().join('&')
+  return `${url.origin}${path}${query ? `?${query}` : ''}`
+}
 /**
  * Ranking scores move with whatever else the shared test database indexed (order is pinned below),
  * and a table's `rowCount` is maintained by a migration trigger a pushed schema does not install.
@@ -76,7 +91,9 @@ function normalize(value: unknown, labels: Map<string, string>): unknown {
           key,
           (MINTED_FIELDS.has(key) && typeof item === 'string') || UNSTABLE_SCORES.has(key)
             ? '<minted>'
-            : normalize(item, labels),
+            : key === 'url' && typeof item === 'string'
+              ? normalizeUrl(item, labels)
+              : normalize(item, labels),
         ])
     )
   }
diff --git a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
index f2122de4cd2..ee52e54213f 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
@@ -1,4 +1,4 @@
-import { ContentRefusedError } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, redactBeforeCutting } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { AgentCliFlags } from '@/lib/mothership/agent-cli/types'
 import { agentCliOk } from '@/lib/mothership/agent-cli/types'
@@ -77,8 +77,15 @@ export async function observePrivateFile(
   if (format) {
     const parsed = await parseFileText(file.buffer, format, file.name)
     const truncated = parsed.metadata?.truncated === true
+    const ranged = options.offset !== undefined || options.limit !== undefined
     const { text, lineRange } = sliceFileTextLines(
-      parsed.content,
+      ranged
+        ? redactBeforeCutting(
+            undefined,
+            parsed.content,
+            file.source === 'knowledge' ? 'knowledge-document' : 'workspace-file'
+          )
+        : parsed.content,
       options.offset,
       options.limit,
       truncated
diff --git a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
index 83fc2c5d55f..49bec631da3 100644
--- a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
@@ -60,7 +60,7 @@ vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
 import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
diff --git a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
index c87c3725e26..3898abb0db8 100644
--- a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
@@ -9,7 +9,7 @@ import {
   type CopilotChatDelegationContext,
   createCopilotChatPrincipal,
 } from '@/lib/mothership/auth/application-delegation'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { v2FileErrorPolicies } from '@/lib/workspace-files/api'
 import { presentWorkspaceFileText } from '@/lib/workspace-files/api/text-presenter'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
index 2d9caa94749..25287a6e7cf 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
@@ -1,7 +1,7 @@
 import { runEmbeddedCli } from 'sim/embed'
 import { describe, expect, it, vi } from 'vitest'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
-import { markCommittedWriteResponse } from '@/lib/mothership/content-delivery/dispatch'
+import { markCommittedWriteResponse } from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 
 const endpoint = 'https://sim.test'
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
index 0f758133cd9..4d76da4ecd4 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
@@ -15,7 +15,7 @@ import * as secrets from '@/lib/api/contracts/v2/secrets'
 import * as tables from '@/lib/api/contracts/v2/tables'
 import * as workflows from '@/lib/api/contracts/v2/workflows'
 import { parseFolderPath } from '@/lib/folders/paths'
-import { isCommittedWriteResponse } from '@/lib/mothership/content-delivery/dispatch'
+import { isCommittedWriteResponse } from '@/lib/mothership/content-delivery'
 import type { ResourceAddress, ResourceChange } from '@/lib/mothership/generated/resources'
 import { findNonTabFileIds } from '@/lib/mothership/resources/file-tabs'
 import { encodeVfsPathSegments } from '@/lib/vfs/path'
diff --git a/apps/sim/lib/mothership/agent-cli/transport.ts b/apps/sim/lib/mothership/agent-cli/transport.ts
index b5b800d826e..f400833f499 100644
--- a/apps/sim/lib/mothership/agent-cli/transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/transport.ts
@@ -6,10 +6,10 @@ import { createTracedCliTransport } from '@/lib/mothership/agent-cli/traced-tran
 import type { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import type { CopilotChatDelegationContext } from '@/lib/mothership/auth/application-delegation'
 import {
+  createRegistryContentGate,
   deliveredFileProvenance,
   dispatchUnderContentGate,
-} from '@/lib/mothership/content-delivery/dispatch'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+} from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.ts b/apps/sim/lib/mothership/chat/application/inline-images.ts
index 49bf6fb913e..56d712d0973 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.ts
@@ -24,7 +24,7 @@ import {
   normalizeInlineChatImage,
   storeInlineChatImage,
 } from '@/lib/mothership/chat/inline-image-storage'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { loadActiveWorkspaceFileContext } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { MAX_TEXT_EXTRACTION_BYTES } from '@/lib/uploads/utils/file-utils'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
index a6df5035da0..b577011acbd 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
@@ -11,7 +11,7 @@ import {
   observeContentDelivery,
 } from '@/lib/core/application/content-delivery'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 
 const hoisted = vi.hoisted(() => ({
   context: vi.fn(),
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 88d7c0836bf..3e18bf60368 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -1152,7 +1152,6 @@ describe('processContextsServer - table_selection contexts', () => {
         legacyKeying: 'ids',
         columns: ['c_name', 'c_amount'],
         limit: 2,
-        includeTotal: true,
       },
     })
     expect(result).toHaveLength(1)
@@ -1412,6 +1411,27 @@ describe('processContextsServer - table_selection contexts', () => {
     expect(context.content).toContain('| r1 | Ada |')
   })
 
+  it('notes rows it did not show without saying why, inside the preview limit', async () => {
+    readTableUseCase.mockResolvedValue({
+      table: { name: 'Sales', schema: { columns: [{ id: 'name', name: 'Name' }] } },
+      folderPath: '/',
+    })
+    queryTableRows.mockResolvedValue({
+      rows: [{ id: 'r1', data: { name: 'Ada' } }],
+      totalCount: null,
+      nextCursor: null,
+    })
+    const [context] = await processContextsServer(
+      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2'] }],
+      'user-1',
+      '',
+      'ws-1'
+    )
+    expect(context.content).toContain('1 selected row is not shown')
+    expect(context.content).not.toContain('r2')
+    expect(context.content).toContain('| r1 | Ada |')
+  })
+
   it('deduplicates row IDs and preserves selection order independently of query order', async () => {
     readTableUseCase.mockResolvedValue({
       table: { name: 'Sales', schema: { columns: [{ id: 'name', name: 'Name' }] } },
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 6b4c0ce94c5..3255694d432 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -52,7 +52,7 @@ import {
   truncateSelectionText,
 } from '@/lib/mothership/chat/selection-context'
 import { quoteChatTranscript } from '@/lib/mothership/chat/text-transcript'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { QueryLogs } from '@/lib/mothership/generated/tool-catalog-v1'
 import { canonicalWorkspaceFilePath } from '@/lib/mothership/vfs/path-utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
@@ -1176,7 +1176,6 @@ async function resolveTableSelectionResource(
           legacyKeying: 'ids',
           columns: columns.map(getColumnId),
           limit: uniqueRowIds.length,
-          includeTotal: true,
         },
       })
   )
@@ -1190,7 +1189,14 @@ async function resolveTableSelectionResource(
     return row ? [row] : []
   })
   if (rows.length === 0) return null
-  const selectedRowCount = result.totalCount ?? rows.length
+  /**
+   * A byte-limited page still has the rest of the selection to read, so those rows count as
+   * omitted for length. Otherwise a missing row was deleted or withheld; the note says so without
+   * telling which.
+   */
+  const missingRows = uniqueRowIds.length - rows.length
+  const pageLimited = result.nextCursor !== null && result.nextCursor !== undefined
+  const selectedRowCount = rows.length + (pageLimited ? missingRows : 0)
 
   const selection = JSON.stringify({
     tableId,
@@ -1236,10 +1242,16 @@ async function resolveTableSelectionResource(
     cellsProjected = false
     return ''
   }
+  const omittedRows = pageLimited ? 0 : missingRows
+  const omittedNote =
+    omittedRows > 0
+      ? `\n\n${omittedRows} selected ${omittedRows === 1 ? 'row is' : 'rows are'} not shown: deleted since the selection, or not available to Chat.`
+      : ''
   const lines: string[] = []
   let remaining =
     MAX_TABLE_SELECTION_PREVIEW_LENGTH -
-    describe(sizeClause(selectedRowCount, selectedRowCount)).length
+    describe(sizeClause(selectedRowCount, selectedRowCount)).length -
+    omittedNote.length
   for (const row of rows) {
     const line = `| ${renderTableCell(row.id)} | ${columns.map((col) => renderTableCell(projectCell(row.data[getColumnId(col)]))).join(' | ')} |`
     if (line.length + 1 > remaining) break
@@ -1249,18 +1261,19 @@ async function resolveTableSelectionResource(
 
   const rendered = `${describe(sizeClause(lines.length, selectedRowCount - lines.length))}${lines.join('\n')}`
   const projected = projectResolvedSecretModelContent(rendered, selectionRegistry)
-  const withheldRows = uniqueRowIds.length - rows.length
-  const withheldNote =
-    withheldRows > 0
-      ? `\n\n${withheldRows} selected ${withheldRows === 1 ? 'row is' : 'rows are'} not shown: ${withheldRows === 1 ? 'its' : 'their'} secret provenance could not be verified.`
-      : ''
   const preview =
     !cellsProjected || !projected.safe || typeof projected.value !== 'string'
       ? `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). Cell values could not be checked for secret values, so none were inlined.`
       : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
-        ? `${projected.value}${withheldNote}`
+        ? `${projected.value}${omittedNote}`
         : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
-  const content = `${selection}\n\n${preview}`
+  /** The descriptor names columns and rows; it is shown to the model too, so it is redacted too. */
+  const projectedSelection = projectResolvedSecretModelContent(selection, selectionRegistry)
+  const descriptor =
+    projectedSelection.safe && typeof projectedSelection.value === 'string'
+      ? projectedSelection.value
+      : JSON.stringify({ tableId })
+  const content = `${descriptor}\n\n${preview}`
   return {
     type: 'table_selection',
     tag: label ? `@${label}` : '@',
diff --git a/apps/sim/lib/mothership/content-delivery/index.ts b/apps/sim/lib/mothership/content-delivery/index.ts
new file mode 100644
index 00000000000..8e61d78283f
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/index.ts
@@ -0,0 +1,8 @@
+export {
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+  isCommittedWriteResponse,
+  markCommittedWriteResponse,
+} from './dispatch'
+export { createRegistryContentGate } from './registry-gate'
+export { createSessionContentGate, WorkbenchProvenanceUnavailableError } from './session-gate'
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
index 404930e3596..6ec738a212c 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -11,8 +11,14 @@ const telemetry = vi.hoisted(() => ({
 }))
 vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
 
-import type { ContentProvenance, ContentSource } from '@/lib/core/application/content-delivery'
+import {
+  type ContentProvenance,
+  type ContentSource,
+  observeContentDelivery,
+  redactBeforeCutting,
+} from '@/lib/core/application/content-delivery'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { sliceFileTextLines } from '@/lib/workspace-files/text-lines'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -100,6 +106,15 @@ describe('createRegistryContentGate', () => {
     expect(modelView(`other=${OTHER_SECRET}`, registry)).toContain(OTHER_SECRET)
   })
 
+  it('activates nothing for a derived view that shows nothing', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET), { derived: undefined })])).toEqual([
+      true,
+    ])
+    expect(modelView(`token=${SECRET}`, registry)).toContain(SECRET)
+  })
+
   it('refuses an opaque view of an item holding secrets, which no redaction reaches', async () => {
     const registry = newRegistry()
     const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
@@ -154,4 +169,18 @@ describe('createRegistryContentGate', () => {
     expect(registry.isPermanentlyIncomplete()).toBe(false)
     expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
   })
+
+  it('redacts a multi-line secret before a line window could cut one line out of it', async () => {
+    const key = ['-----BEGIN FIXTURE KEY-----', 'FIXTURELINEONE0123', 'FIXTURELINETWO4567'].join(
+      '\n'
+    )
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const text = `config\n${key}\nend`
+    const window = await observeContentDelivery(gate, async () => {
+      expect(await gate.admit([item('key-file', exact(key))])).toEqual([true])
+      return sliceFileTextLines(redactBeforeCutting(undefined, text, 'workspace-file'), 2, 1, false)
+    })
+    for (const line of key.split('\n')) expect(window.text).not.toContain(line)
+  })
 })
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index 1d6eee3091c..ccbe3c9d1ad 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -9,6 +9,7 @@ import {
   type ContentRefusalReason,
   reportContentRefusal,
 } from '@/lib/mothership/content-delivery/telemetry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface RegistryContentGateScope {
@@ -58,6 +59,8 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
     if (source.view === 'opaque') return refuse(source, 'opaque')
     const registry = scope.registry
     if (!registry) return refuse(source, 'registry')
+    /** A derived view that shows nothing needs no entry; `undefined` would mean the whole item. */
+    if (typeof source.view === 'object' && source.view.derived === undefined) return true
     const value = typeof source.view === 'object' ? source.view.derived : undefined
     const staged = new ResolvedSecretTraceRegistry([], undefined, { staged: true })
     if (!(await importDurableSecretProvenance(staged, provenance, value))) {
@@ -73,6 +76,15 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
   }
 
   return {
+    project(text) {
+      /** Without a registry no admitted item holds a secret, so there is nothing to redact. */
+      if (!scope.registry) return text
+      const projection = projectResolvedSecretModelContent(
+        text,
+        scope.registry.forkForPropagatedEntries()
+      )
+      return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
+    },
     async admit(sources) {
       const unrecorded: DurableSecretProvenanceUnrecordedReport[] = []
       const verdicts: boolean[] = []
diff --git a/apps/sim/lib/mothership/tool-executor/executor.ts b/apps/sim/lib/mothership/tool-executor/executor.ts
index 753c0b6ab16..a733f906abc 100644
--- a/apps/sim/lib/mothership/tool-executor/executor.ts
+++ b/apps/sim/lib/mothership/tool-executor/executor.ts
@@ -6,7 +6,7 @@ import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-i
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import { ASSISTANT_TOOLS, isAssistantIntegrationTool } from '@/lib/mothership/assistant/tool-policy'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
 import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import { projectToolErrorMessageForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
index 93dd7f42faf..f45da265bb1 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
@@ -36,7 +36,7 @@ vi.mock('@/tools', () => toolsMock)
 
 import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import type { ToolExecutionContext } from '@/lib/mothership/tool-executor/types'
 import {
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute.ts b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
index 466731341dd..6b2fe88d1e4 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
@@ -36,7 +36,7 @@ import { resolveCopilotFilePrincipal } from '@/lib/mothership/auth/file-delegati
 import { messageForCopilotTableError } from '@/lib/mothership/auth/table-delegation'
 import { recordServiceCost } from '@/lib/mothership/billing/service-observer'
 import { readChatAttachment } from '@/lib/mothership/chat/application/read-attachment'
-import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { WorkbenchSecretNames } from '@/lib/mothership/generated/workbench'
 import { applySecretMountPolicy } from '@/lib/mothership/secret-mount-policy'
 import type {
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index d57bba22b13..30924d50226 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -10,13 +10,11 @@ import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import {
+  createSessionContentGate,
   dispatchUnderContentGate,
   markCommittedWriteResponse,
-} from '@/lib/mothership/content-delivery/dispatch'
-import {
-  createSessionContentGate,
   WorkbenchProvenanceUnavailableError,
-} from '@/lib/mothership/content-delivery/session-gate'
+} from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 import {
   readSandboxResourceScope,
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
index 642253772e9..3b0e36aef0f 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
@@ -8,7 +8,9 @@ const {
   readWorkspaceFileContentMock,
   readWorkspaceFileMetadataMock,
   storeCompiledDocMock,
+  runSandboxTaskMock,
 } = vi.hoisted(() => ({
+  runSandboxTaskMock: vi.fn(),
   loadCompiledDocMock: vi.fn(),
   publishCompiledDocArtifactMock: vi.fn(),
   readWorkspaceFileContentMock: vi.fn(),
@@ -26,6 +28,7 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => (
 vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () => ({
   readWorkspaceFileMetadata: { execute: readWorkspaceFileMetadataMock },
 }))
+vi.mock('@/lib/execution/sandbox/run-task', () => ({ runSandboxTask: runSandboxTaskMock }))
 vi.mock('./doc-compiled-store', () => ({
   loadCompiledDoc: loadCompiledDocMock,
   loadPublishedCompiledDoc: vi.fn(),
@@ -33,6 +36,11 @@ vi.mock('./doc-compiled-store', () => ({
   storeCompiledDoc: storeCompiledDocMock,
 }))
 
+import {
+  type ContentDeliveryGate,
+  observeContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { collectReferencedFileIds, compileDoc } from './doc-compile'
 
 const executeInSandboxMock = remoteSandboxMockFns.mockExecuteInSandbox
@@ -246,3 +254,78 @@ describe('collectReferencedFileIds', () => {
     )
   })
 })
+
+describe('isolated-VM compile for Chat', () => {
+  beforeEach(() => {
+    setEnvFlags({ isDocSandboxEnabled: false })
+  })
+
+  it('rebuilds a cached build that read an older version of a file it names', async () => {
+    const chat = createCopilotChatFilePrincipal({
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+      chatId: 'chat-1',
+    })
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    const version = (at: string) => {
+      const contentUpdatedAt = new Date(at)
+      return {
+        id: ID,
+        workspaceId: 'workspace-1',
+        name: 'reference.png',
+        key: `workspace/workspace-1/${ID}-reference.png`,
+        path: '/api/files/serve/reference.png',
+        size: 10,
+        type: 'image/png',
+        uploadedBy: 'user-1',
+        uploadedAt: contentUpdatedAt,
+        updatedAt: contentUpdatedAt,
+        contentUpdatedAt,
+        storageContext: 'workspace' as const,
+      }
+    }
+    runSandboxTaskMock.mockImplementation(
+      async (
+        _task: string,
+        _input: unknown,
+        options: { onWorkspaceFileAccess?: (identity: unknown) => void }
+      ) => {
+        const { file } = await readWorkspaceFileMetadataMock()
+        options.onWorkspaceFileAccess?.({
+          fileId: ID,
+          key: file.key,
+          context: 'workspace',
+          contentUpdatedAt: file.contentUpdatedAt,
+        })
+        return Buffer.from('%PDF-built')
+      }
+    )
+    const compile = () =>
+      observeContentDelivery(admitAll, () =>
+        compileDoc({
+          source: `image = await getFileBase64('${ID}') // cache-version`,
+          fileName: 'report.pdf',
+          workspaceId: 'workspace-1',
+          filePrincipal: chat,
+        })
+      )
+    readWorkspaceFileMetadataMock.mockResolvedValue({
+      file: version('2026-08-05T00:00:00.000Z'),
+      share: null,
+    })
+    await compile()
+    await compile()
+    expect(runSandboxTaskMock).toHaveBeenCalledOnce()
+
+    readWorkspaceFileMetadataMock.mockResolvedValue({
+      file: version('2026-08-06T00:00:00.000Z'),
+      share: null,
+    })
+    await compile()
+    expect(runSandboxTaskMock).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index ec11238190f..40d9ba4f82b 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -1,7 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
-import { mustClassifyContent } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, mustClassifyContent } from '@/lib/core/application/content-delivery'
 import { isDocSandboxEnabled } from '@/lib/core/config/env-flags'
 import { CodeLanguage } from '@/lib/execution/languages'
 import {
@@ -20,7 +20,7 @@ import {
 } from '@/lib/mothership/tools/server/files/doc-compiled-store'
 import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
 import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
+import { admitWorkspaceFiles } from '@/lib/workspace-files/application/admit-file-content'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import { getContentType } from '@/app/api/files/utils'
@@ -670,14 +670,33 @@ const COMPILABLE_FORMATS: Record<string, CompilableFormat> = {
  * literally, each admitted by the caller's gate before the task runs. Other callers are
  * unrestricted, as they have always been.
  */
-async function admitBrokerFiles(args: LegacyCompileArgs): Promise<ReadonlySet<string> | undefined> {
+async function admitBrokerFiles(
+  args: LegacyCompileArgs
+): Promise<ReadonlyMap<string, ResolvedReferencedImage['record']> | undefined> {
   const principal = args.filePrincipal
   if (!principal || !mustClassifyContent(principal)) return undefined
   const { images } = await resolveReferencedImages(args.source, args.workspaceId, principal)
-  for (const { record } of images) {
-    await requireAdmittedWorkspaceFile(principal, args.workspaceId, record, 'complete')
-  }
-  return new Set(images.map((image) => image.fileId))
+  const records = images.map((image) => image.record)
+  const admitted = await admitWorkspaceFiles(principal, args.workspaceId, records, 'complete')
+  if (admitted.length < records.length) throw new ContentRefusedError('workspace-file')
+  return new Map(admitted.map((record) => [record.id, record]))
+}
+
+/** Whether a cached build read exactly the versions this compile admitted, and nothing else. */
+function cachedFromAdmittedVersions(
+  contributors: readonly WorkspaceFileSecretProvenanceIdentity[],
+  admitted: ReadonlyMap<string, ResolvedReferencedImage['record']>
+): boolean {
+  return contributors.every((contributor) => {
+    const record = admitted.get(contributor.fileId)
+    return (
+      record !== undefined &&
+      record.key === contributor.key &&
+      (record.storageContext ?? 'workspace') === contributor.context &&
+      (record.contentUpdatedAt ?? record.updatedAt).getTime() ===
+        contributor.contentUpdatedAt?.getTime()
+    )
+  })
 }
 
 async function compileDocInLegacySandbox(
@@ -695,13 +714,13 @@ async function compileDocInLegacySandbox(
   }
 
   /** Admitted before the cache too: a cached build may embed a file the gate now refuses. */
-  const readableWorkspaceFileIds = await admitBrokerFiles(args)
+  const admittedFiles = await admitBrokerFiles(args)
+  const readableWorkspaceFileIds = admittedFiles ? new Set(admittedFiles.keys()) : undefined
   const cacheKey = sha256Hex(`.${fmt.ext}${args.source}${args.workspaceId}`)
   const cached = compiledDocCache.get(cacheKey)
-  /** A build another caller made may have read files this compile may not; it rebuilds instead. */
+  /** A build that read another file, or another version of one, is rebuilt for this compile. */
   const cacheReadable =
-    !readableWorkspaceFileIds ||
-    (cached?.contributingFiles ?? []).every((file) => readableWorkspaceFileIds.has(file.fileId))
+    !admittedFiles || cachedFromAdmittedVersions(cached?.contributingFiles ?? [], admittedFiles)
   if (cached && cacheReadable) {
     return {
       buffer: cached.buffer,
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index b6ddcb36be8..e98b5bb061a 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -29,7 +29,9 @@ const {
   mockRowProvenance,
   mockFindRowMatches,
   mockClassifyColumns,
+  mockTableHasUnvouchedRows,
 } = vi.hoisted(() => ({
+  mockTableHasUnvouchedRows: vi.fn(),
   mockFindRowMatches: vi.fn(),
   mockClassifyColumns: vi.fn(),
   mockIsScopeCompatible: vi.fn(),
@@ -58,6 +60,7 @@ vi.mock('@/lib/table/column-types', () => ({
 vi.mock('@/lib/table/rows/secret-provenance', () => ({
   ...tableRowsSecretProvenanceMock,
   classifyStoredTableRowColumns: mockClassifyColumns,
+  tableHasUnvouchedRows: mockTableHasUnvouchedRows,
   TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
     rowProvenance(rowId: string) {
       return mockRowProvenance(rowId)
@@ -994,6 +997,57 @@ describe('row delivery to Chat', () => {
     }
   )
 
+  describe('query counts Chat sees', () => {
+    const filtered = (principal: Caller) =>
+      queryTableRows.execute({
+        principal,
+        input: {
+          tableId: TABLE.id,
+          limit: 25,
+          includeTotal: true,
+          predicate: { all: [{ field: 'name', op: 'eq', value: 'guess' }] },
+        },
+      })
+
+    beforeEach(() => {
+      mockQueryRows.mockResolvedValue({ ...PAGE, rowCount: 1, totalCount: 3 })
+    })
+
+    it('counts only the rows delivered on the page', async () => {
+      mockRowProvenance.mockReturnValue({ status: 'unknown' })
+      mockTableHasUnvouchedRows.mockResolvedValue(false)
+      const result = await observeContentDelivery({ admit: gate(false) }, () => filtered(CHAT))
+      expect(result).toMatchObject({ rows: [], rowCount: 0, totalCount: 3 })
+    })
+
+    it('refuses a filtered total over a table holding rows Chat may not read', async () => {
+      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
+      mockTableHasUnvouchedRows.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () => filtered(CHAT))
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+    })
+
+    it('keeps an unfiltered total, which says only how many rows exist', async () => {
+      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
+      mockTableHasUnvouchedRows.mockResolvedValue(true)
+      const result = await observeContentDelivery({ admit: gate(true) }, () =>
+        queryTableRows.execute({
+          principal: CHAT,
+          input: { tableId: TABLE.id, limit: 25, includeTotal: true },
+        })
+      )
+      expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
+      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+    })
+
+    it('answers a person with the stored counts, unread', async () => {
+      const result = await filtered(PRINCIPAL)
+      expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
+      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+    })
+  })
+
   it.each(['read', 'enrichment'] as const)('%s refuses a refused row with a 403', async (name) => {
     mockRowProvenance.mockReturnValue({ status: 'unknown' })
     await expect(
@@ -1097,6 +1151,11 @@ describe('row delivery to Chat', () => {
       { ordinal: 0, rowId: 'row-a', column: 'col-secret' },
       { ordinal: 1, rowId: 'row-b', column: 'col-plain' },
     ]
+    const READ_AT = new Date('2026-01-01')
+    const REVISIONS = new Map([
+      ['row-a', READ_AT],
+      ['row-b', READ_AT],
+    ])
     const search = (principal: Caller) =>
       searchTableRows.execute({ principal, input: { tableId: TABLE.id, q: 'needle' } })
 
@@ -1110,20 +1169,46 @@ describe('row delivery to Chat', () => {
     })
 
     it('does not signal truncation through a match it withheld', async () => {
-      mockFindRowMatches.mockResolvedValue({ matches: MATCHES, truncated: true })
+      mockFindRowMatches.mockResolvedValue({
+        matches: MATCHES,
+        truncated: true,
+        revisions: REVISIONS,
+      })
       const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
       expect(result.matches).toEqual([MATCHES[0]])
       expect(result.truncated).toBe(false)
     })
 
     it('keeps truncation when every match on a capped page was admitted', async () => {
-      mockFindRowMatches.mockResolvedValue({ matches: [MATCHES[0]], truncated: true })
+      mockFindRowMatches.mockResolvedValue({
+        matches: [MATCHES[0]],
+        truncated: true,
+        revisions: REVISIONS,
+      })
       const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
       expect(result).toMatchObject({ matches: [MATCHES[0]], truncated: true })
     })
 
+    it('classifies each match at the revision the search read, dropping one it cannot bind', async () => {
+      mockFindRowMatches.mockResolvedValue({
+        matches: MATCHES,
+        truncated: false,
+        revisions: new Map([['row-a', READ_AT]]),
+      })
+      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
+      expect(mockClassifyColumns).toHaveBeenCalledWith([
+        { id: 'row-a', updatedAt: READ_AT },
+        { id: 'row-a', updatedAt: READ_AT },
+      ])
+      expect(result.matches).toEqual([MATCHES[0]])
+    })
+
     it('answers a person with every match and the raw truncation', async () => {
-      mockFindRowMatches.mockResolvedValue({ matches: MATCHES, truncated: true })
+      mockFindRowMatches.mockResolvedValue({
+        matches: MATCHES,
+        truncated: true,
+        revisions: REVISIONS,
+      })
       const result = await search(PRINCIPAL)
       expect(result).toMatchObject({ matches: MATCHES, truncated: true })
       expect(mockClassifyColumns).not.toHaveBeenCalled()
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index 897316fb7bb..893371749e1 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -10,6 +10,7 @@ import {
   admitContent,
   admitWrittenContent,
   ContentRefusedError,
+  isCopilotPrincipal,
   mustClassifyContent,
 } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -93,6 +94,7 @@ import {
   createTableRowSecretProvenanceFromRegistry,
   createUnknownTableRowSecretProvenance,
   TableRowProvenanceReader,
+  tableHasUnvouchedRows,
 } from '@/lib/table/rows/secret-provenance'
 import type { FindRowMatch, RowWriteOptions } from '@/lib/table/rows/service'
 import { replaceTableRowsWithTx } from '@/lib/table/rows/service'
@@ -563,6 +565,29 @@ export interface QueryTableRowsResult extends TableResult {
   secretProvenance?: TableRowsProvenance
 }
 
+/**
+ * The counts a query reports, as Chat may see them. The page's count is always the rows delivered.
+ * A filtered total also counts rows Chat may not read, which would answer the filter's question
+ * about their text, so Chat gets it only when every row of the table can be vouched for; otherwise
+ * the count is refused. An unfiltered total says only how many rows exist. Other callers are
+ * unchanged.
+ */
+async function countsForReader(
+  principal: Principal,
+  tableId: string,
+  result: Pick<QueryTableRowsResult, 'rowCount' | 'totalCount'>,
+  delivered: readonly unknown[],
+  query: { filtered: boolean }
+): Promise<Pick<QueryTableRowsResult, 'rowCount' | 'totalCount'>> {
+  if (!isCopilotPrincipal(principal)) {
+    return { rowCount: result.rowCount, totalCount: result.totalCount }
+  }
+  if (result.totalCount !== null && query.filtered && (await tableHasUnvouchedRows(tableId))) {
+    throw new ContentRefusedError('table-row')
+  }
+  return { rowCount: delivered.length, totalCount: result.totalCount }
+}
+
 export const queryTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.queryRows,
   resolveContext: ({ input }: { input: QueryTableRowsInput }) => resolveActiveTableContext(input),
@@ -654,6 +679,9 @@ export const queryTableRows = defineAuthorizedTableUseCase({
       return {
         table: context.table,
         ...result,
+        ...(await countsForReader(principal, context.table.id, result, rows, {
+          filtered: Boolean(predicate || legacyFilter),
+        })),
         rows: rowsForReader(principal, rows),
         ...(input.includePersistedSecretProvenance && readProvenance
           ? { secretProvenance: readProvenance.exportProvenance() }
@@ -672,13 +700,20 @@ export const queryTableRows = defineAuthorizedTableUseCase({
  */
 async function admitRowMatches(
   principal: Principal,
-  matches: FindRowMatch[]
+  matches: FindRowMatch[],
+  revisions: ReadonlyMap<string, Date | string>
 ): Promise<FindRowMatch[]> {
   if (matches.length === 0 || !mustClassifyContent(principal)) {
     await admitContent(principal, [])
     return matches
   }
-  const columns = await classifyStoredTableRowColumns(matches.map((match) => match.rowId))
+  /** Classified at the revision the search matched, so a later write cannot vouch for it. */
+  const columns = await classifyStoredTableRowColumns(
+    matches.flatMap((match) => {
+      const updatedAt = revisions.get(match.rowId)
+      return updatedAt === undefined ? [] : [{ id: match.rowId, updatedAt }]
+    })
+  )
   const sources = [...columns].map(([rowId, classification]) => ({
     kind: 'table-row' as const,
     id: rowId,
@@ -735,7 +770,7 @@ export const searchTableRows = defineAuthorizedTableUseCase({
         { q: input.q, filter, sort },
         requestId(input)
       )
-      const matches = await admitRowMatches(principal, result.matches)
+      const matches = await admitRowMatches(principal, result.matches, result.revisions)
       return {
         table: context.table,
         matches,
diff --git a/apps/sim/lib/table/rows/secret-provenance.test.ts b/apps/sim/lib/table/rows/secret-provenance.test.ts
index 7cf5401b4eb..74925491df8 100644
--- a/apps/sim/lib/table/rows/secret-provenance.test.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.test.ts
@@ -5,6 +5,7 @@ import { eq } from 'drizzle-orm'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DbTransaction } from '@/lib/table/planner'
 import {
+  classifyStoredTableRowColumns,
   classifyTableRowSecretProvenanceForCopy,
   getTableSnapshotModelMountSafety,
   loadTableRowSecretProvenance,
@@ -297,6 +298,49 @@ describe('table row secret provenance', () => {
     })
   })
 
+  it('classifies matched columns only at the revision the search read', async () => {
+    const SECRET_ENTRY = {
+      columnId: 'secret-column',
+      encryptedValue: 'encrypted-local',
+      name: 'LOCAL_SECRET',
+      sourceUserId: 'user-1',
+      sourceWorkspaceId: 'workspace-1',
+    }
+    const later = new Date(ROW_UPDATED_AT.getTime() + 1)
+    queueTableRows(userTableRows, [
+      {
+        id: 'read-row',
+        updatedAt: ROW_UPDATED_AT,
+        secretProvenanceVersion: 1,
+        sidecarRowId: 'read-row',
+        sidecarStatus: 'exact',
+        sidecarEntries: [SECRET_ENTRY],
+        sidecarIsCurrent: true,
+      },
+      {
+        id: 'rewritten-row',
+        updatedAt: later,
+        secretProvenanceVersion: 1,
+        sidecarRowId: 'rewritten-row',
+        sidecarStatus: 'exact',
+        sidecarEntries: [],
+        sidecarIsCurrent: true,
+      },
+    ])
+    const columns = await classifyStoredTableRowColumns([
+      { id: 'read-row', updatedAt: ROW_UPDATED_AT },
+      { id: 'rewritten-row', updatedAt: ROW_UPDATED_AT },
+      { id: 'missing-row', updatedAt: ROW_UPDATED_AT },
+    ])
+    expect(columns.get('read-row')).toEqual({
+      status: 'exact',
+      secretColumns: new Set(['secret-column']),
+    })
+    /** Its clean sidecar describes text written after the match: it cannot vouch for the match. */
+    expect(columns.get('rewritten-row')).toEqual({ status: 'unknown' })
+    expect(columns.get('missing-row')).toEqual({ status: 'unknown' })
+  })
+
   it('rejects contradictory duplicate row crossings before reading provenance', async () => {
     await expect(
       loadTableRowSecretProvenance(
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index cb6dfdb2503..717d4531207 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -947,21 +947,67 @@ async function classifyTableRowCrossings(
 }
 
 /**
- * For each row as it is stored now, the columns whose cells hold a recorded secret, or `unknown`
- * when the row cannot be vouched for. A match oracle (row search) consults it: a cell that matched
- * reveals something about its text whatever the result shows.
+ * Whether any row of a table cannot be vouched for: tracked, but with no current exact sidecar.
+ * A count over a filter that such a row matches would answer a question about text Chat may not
+ * read, so a Chat count is taken only over a table where every row can be vouched for.
+ */
+export async function tableHasUnvouchedRows(
+  tableId: string,
+  executor: DbExecutor = db
+): Promise<boolean> {
+  const [row] = await executor
+    .select({ id: userTableRows.id })
+    .from(userTableRows)
+    .leftJoin(
+      userTableRowSecretProvenance,
+      eq(userTableRowSecretProvenance.rowId, userTableRows.id)
+    )
+    .where(
+      and(
+        eq(userTableRows.tableId, tableId),
+        sql`${userTableRows.secretProvenanceVersion} IS NOT NULL`,
+        sql`(${userTableRows.secretProvenanceVersion} <> ${TABLE_ROW_SECRET_PROVENANCE_VERSION}
+          OR ${userTableRowSecretProvenance.status} IS DISTINCT FROM 'exact'
+          OR ${userTableRowSecretProvenance.contentUpdatedAt} IS DISTINCT FROM ${userTableRows.updatedAt})`
+      )
+    )
+    .limit(1)
+  return row !== undefined
+}
+
+/**
+ * For each row as it was read, the columns whose cells hold a recorded secret, or `unknown` when
+ * the row cannot be vouched for. A match oracle (row search) consults it: a cell that matched
+ * reveals something about its text whatever the result shows. A row whose stored revision is no
+ * longer the one the caller read is `unknown`: its sidecar describes other text.
  */
 export async function classifyStoredTableRowColumns(
-  rowIds: readonly string[],
+  rows: readonly { id: string; updatedAt: Date | string }[],
   executor: DbExecutor = db
 ): Promise<Map<string, { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }>> {
-  const ids = [...new Set(rowIds)]
+  const readAt = new Map<string, Date | string>()
+  const conflicting = new Set<string>()
+  for (const row of rows) {
+    const seen = readAt.get(row.id)
+    if (seen !== undefined && !sameTimestamp(seen, row.updatedAt)) conflicting.add(row.id)
+    readAt.set(row.id, row.updatedAt)
+  }
+  const ids = [...readAt.keys()]
   const currentRows = await selectRowsWithSidecars(executor, ids)
   const result = new Map<
     string,
     { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }
   >()
   for (const current of currentRows) {
+    const expected = readAt.get(current.id)
+    if (
+      conflicting.has(current.id) ||
+      expected === undefined ||
+      !sameTimestamp(current.updatedAt, expected)
+    ) {
+      result.set(current.id, { status: 'unknown' })
+      continue
+    }
     if (current.secretProvenanceVersion === null) {
       result.set(current.id, { status: 'exact', secretColumns: new Set() })
       continue
diff --git a/apps/sim/lib/table/rows/service.ts b/apps/sim/lib/table/rows/service.ts
index 62d70d4e839..cc10af853b3 100644
--- a/apps/sim/lib/table/rows/service.ts
+++ b/apps/sim/lib/table/rows/service.ts
@@ -1098,12 +1098,16 @@ export async function findRowMatches(
   table: TableDefinition,
   options: { q: string; filter?: Filter; sort?: Sort },
   requestId: string
-): Promise<{ matches: FindRowMatch[]; truncated: boolean }> {
+): Promise<{
+  matches: FindRowMatch[]
+  truncated: boolean
+  revisions: ReadonlyMap<string, Date | string>
+}> {
   const tableName = USER_TABLE_ROWS_SQL_NAME
   const columns = table.schema.columns
   // Row data is keyed by stable column id, so scan/return JSONB keys as ids.
   const columnIds = columns.map(getColumnId)
-  if (columnIds.length === 0) return { matches: [], truncated: false }
+  if (columnIds.length === 0) return { matches: [], truncated: false, revisions: new Map() }
 
   // Same visibility rule as queryRows: don't surface rows a running delete job will remove.
   const deleteMask = await pendingDeleteMask(table)
@@ -1145,14 +1149,17 @@ export async function findRowMatches(
     return trx.execute<{
       ordinal: string | number
       id: string
+      updated_at_ms: string | number
       column_name: string
     }>(sql`
       WITH ordered AS (
-        SELECT id, data, row_number() OVER (ORDER BY ${orderBySql}) - 1 AS ordinal
+        SELECT id, data, updated_at, row_number() OVER (ORDER BY ${orderBySql}) - 1 AS ordinal
         FROM ${userTableRows}
         WHERE ${whereClause}
       )
-      SELECT o.ordinal, o.id, kv.key AS column_name
+      SELECT o.ordinal, o.id,
+        floor(extract(epoch FROM o.updated_at) * 1000)::bigint AS updated_at_ms,
+        kv.key AS column_name
       FROM ordered o
       CROSS JOIN LATERAL jsonb_each_text(o.data) kv
       WHERE (kv.value ILIKE ${pattern}${nameMatchClause})
@@ -1170,12 +1177,18 @@ export async function findRowMatches(
     rowId: r.id,
     column: r.column_name,
   }))
+  /**
+   * The revision each match was read at, for a caller that classifies what matched. Read as epoch
+   * milliseconds: the raw driver returns this zone-less timestamp as local-time text with
+   * microseconds, which would never equal the ORM's UTC, millisecond `Date` for the same row.
+   */
+  const revisions = new Map(sliced.map((r) => [r.id, new Date(Number(r.updated_at_ms))]))
 
   logger.info(
     `[${requestId}] Find "${options.q}" in table ${table.id}: ${matches.length} match(es)${truncated ? ' (truncated)' : ''}`
   )
 
-  return { matches, truncated }
+  return { matches, truncated, revisions }
 }
 
 /**
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
index 5b2b080462d..d8e1a19a3d5 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.test.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -168,6 +168,17 @@ describe('withholdUnadmittedInlineFiles', () => {
     expect(result.node.file).not.toHaveProperty('base64')
   })
 
+  it('keeps an own `__proto__` key as data in the copy', async () => {
+    const output = JSON.parse('{"__proto__":{"note":"kept"},"files":[]}')
+    output.files.push(runFile('secret', { base64: 'c2VjcmV0' }))
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(Object.getPrototypeOf(result)).toBe(Object.prototype)
+    expect(Object.hasOwn(result, '__proto__')).toBe(true)
+    expect(result.files[0]).not.toHaveProperty('base64')
+  })
+
   it('refuses refused bytes held by an object it cannot rebuild', async () => {
     class Envelope {
       constructor(readonly file: UserFile) {}
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
index 0830a36b7e3..7afb1b564a6 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -76,7 +76,13 @@ function withoutUnadmittedBase64(
   const record: Record<string, unknown> = prototype === null ? Object.create(null) : {}
   seen.set(value, record)
   for (const [key, item] of Object.entries(value)) {
-    record[key] = withoutUnadmittedBase64(item, admittedKeys, seen)
+    /** Defined, not assigned: a `__proto__` key stays a key instead of replacing the prototype. */
+    Object.defineProperty(record, key, {
+      value: withoutUnadmittedBase64(item, admittedKeys, seen),
+      enumerable: true,
+      writable: true,
+      configurable: true,
+    })
   }
   return record
 }
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
index 39917f92800..44f94d35eaa 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { redactBeforeCutting } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isSupportedFileType } from '@/lib/file-parsers'
@@ -172,8 +173,9 @@ export async function extractWorkspaceFileRecordText(
   const metadata = parsed.metadata ?? {}
 
   const truncated = metadata.truncated === true
+  const ranged = input.offset !== undefined || input.limit !== undefined
   const { text, lineRange } = sliceFileTextLines(
-    parsed.content,
+    ranged ? redactBeforeCutting(principal, parsed.content, 'workspace-file') : parsed.content,
     input.offset,
     input.limit,
     truncated
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
index 3133a79bbde..498530355e3 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
@@ -78,8 +78,15 @@ function copilotPrincipal() {
   return copilot
 }
 
+/** Every file this suite shares reads as `provenance` now; clean unless a test says otherwise. */
+function currentProvenance(value: unknown) {
+  provenance.current.mockImplementation(
+    async (_workspaceId: string, ids: readonly string[]) => new Map(ids.map((id) => [id, value]))
+  )
+}
+
 beforeEach(() => {
-  provenance.bound.mockResolvedValue({ status: 'exact', entries: [] })
+  currentProvenance({ status: 'exact', entries: [] })
 })
 
 describe('getWorkspaceFileShares', () => {
@@ -219,20 +226,40 @@ describe('updateWorkspaceFileShare password references', () => {
   it.each([
     { status: 'unknown' },
     { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }] },
-  ])('refuses Chat a live link to a file its gate refuses: %j', async (refused) => {
-    provenance.bound.mockResolvedValue(refused)
-    environment({ SHARE_PW: 'resolved-share-password' })
-    await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toBeInstanceOf(
-      ContentRefusedError
-    )
-    expect(mocks.upsertFileShare).not.toHaveBeenCalled()
-  })
+  ])(
+    'refuses Chat a live link to a file holding a secret or of unknown provenance: %j',
+    async (refused) => {
+      currentProvenance(refused)
+      environment({ SHARE_PW: 'resolved-share-password' })
+      await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toBeInstanceOf(
+        ContentRefusedError
+      )
+      expect(mocks.upsertFileShare).not.toHaveBeenCalled()
+    }
+  )
 
   it('lets a person share a file whatever its provenance', async () => {
-    provenance.bound.mockResolvedValue({ status: 'unknown' })
+    currentProvenance({ status: 'unknown' })
     await share(principal, 'a-long-literal-password-value')
     expect(mocks.upsertFileShare).toHaveBeenCalled()
-    expect(provenance.bound).not.toHaveBeenCalled()
+    expect(provenance.current).not.toHaveBeenCalled()
+  })
+
+  it('refuses a secret-bearing file even under a gate that admits it, such as the workbench', async () => {
+    currentProvenance({
+      status: 'exact',
+      entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }],
+    })
+    environment({ SHARE_PW: 'resolved-share-password' })
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    await expect(
+      observeContentDelivery(admitAll, () => share(copilotPrincipal(), '{{SHARE_PW}}'))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.upsertFileShare).not.toHaveBeenCalled()
   })
 
   it('keeps a reference literal for any other caller, under the same rules', async () => {
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
index 2dae3a5bb63..96feb5797b6 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
@@ -8,8 +8,8 @@ import {
 } from '@/lib/api/contracts/public-shares'
 import {
   admitContent,
-  admitEach,
   ContentRefusedError,
+  isCopilotPrincipal,
 } from '@/lib/core/application/content-delivery'
 import { resolveCopilotSecretReference } from '@/lib/core/application/environment-reference'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -24,8 +24,10 @@ import {
   getWorkspaceFile,
   loadActiveWorkspaceContext,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import { getCurrentWorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
+import {
+  getCurrentWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -75,24 +77,27 @@ export class WorkspaceFileShareNoopError extends Error {
 }
 
 /**
- * A live link serves a file's raw bytes to whoever opens it, so Chat may see a link only to a file
- * whose bytes it could be handed directly; returns the ids whose links may be shown.
+ * A live link serves a file's current bytes to whoever opens it, outside every gate: no registry
+ * redacts them and no workbench history follows them. So Chat may create or see a link only to a
+ * file holding no recorded secret, whichever surface it acts through (D1).
  */
+function isShareableByChat(provenance: WorkspaceFileSecretProvenance | undefined): boolean {
+  return (
+    provenance?.status === 'unrecorded' ||
+    (provenance?.status === 'exact' && provenance.entries.length === 0)
+  )
+}
+
+/** The ids whose live links Chat may see; every other caller sees them all, unread. */
 async function admitSharedFiles(
   principal: Principal,
   workspaceId: string,
   fileIds: readonly string[]
 ): Promise<Set<string>> {
-  const admitted = await admitEach(principal, fileIds, async (ids) => {
-    const provenance = await getCurrentWorkspaceFileSecretProvenance(workspaceId, ids)
-    return ids.map((id) => ({
-      kind: 'workspace-file' as const,
-      id,
-      provenance: provenance.get(id) ?? { status: 'unknown' as const },
-      view: 'opaque' as const,
-    }))
-  })
-  return new Set(admitted)
+  await admitContent(principal, [])
+  if (!isCopilotPrincipal(principal) || fileIds.length === 0) return new Set(fileIds)
+  const provenance = await getCurrentWorkspaceFileSecretProvenance(workspaceId, fileIds)
+  return new Set(fileIds.filter((id) => isShareableByChat(provenance.get(id))))
 }
 
 export const getWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
@@ -188,8 +193,8 @@ export const updateWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
     const effectiveAuthType = input.authType ?? existingShare?.authType ?? 'public'
     if (input.isActive) {
       await validatePublicFileSharing(userId, context.workspaceId, effectiveAuthType)
-      /** A link serves the file's raw bytes to whoever opens it, past any redaction (D1). */
-      await requireAdmittedWorkspaceFile(principal, context.workspaceId, context.file, 'opaque')
+      const [shareable] = await admitSharedFiles(principal, context.workspaceId, [context.fileId])
+      if (!shareable) throw new ContentRefusedError('workspace-file')
     } else {
       await admitContent(principal, [])
     }

From 3d3937f655b0a7a05129e20bb83029154e229ff6 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 12 Oct 2026 16:01:54 -0700
Subject: [PATCH 05/13] fix(mothership): refuse Chat table predicates over
 unsafe cells

A table read whose rows, counts, cursor or affected count depend on cell
values is refused for Chat, before the predicate runs, when the table has an
unvouched row or a secret in a referenced column. Inline run-file bytes are
collected per storage key, and table-selection fallbacks are projected.
---
 .../content-delivery.integration.ts           |  71 +++++++--
 .../lib/mothership/chat/process-contents.ts   |  14 +-
 apps/sim/lib/table/application/rows.test.ts   |  90 +++++++----
 apps/sim/lib/table/application/rows.ts        | 146 +++++++++++++-----
 apps/sim/lib/table/rows/secret-provenance.ts  |  48 +++++-
 .../application/admit-run-files.test.ts       |  11 ++
 .../workflows/application/admit-run-files.ts  |  54 +++++--
 7 files changed, 333 insertions(+), 101 deletions(-)

diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index b6de3876fce..30788f93dae 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -51,8 +51,9 @@ vi.mock('@/lib/mothership/async-runs/repository', async (importOriginal) => ({
 }))
 
 import { db } from '@sim/db'
-import { copilotChats } from '@sim/db/schema'
+import { copilotChats, userTableRowSecretProvenance } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
+import { eq, sql } from 'drizzle-orm'
 import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
@@ -329,16 +330,68 @@ describe('content reaching Chat is admitted per item', () => {
       expectPerItem(read, { secretAdmitted: true })
     })
 
-    it('drops row-search matches that would probe unadmitted cells (#18b)', async () => {
-      const read = await cli('POST', `/api/v2/tables/${fixture.table.tableId}/rows/search`, {
+    it('refuses predicates over a table whose cells it cannot vouch for (#18b)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const guess = { field: 'note', op: 'contains', value: 'second' }
+      const refused = [
+        await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' }),
+        await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess, limit: 1 }),
+        await cli('POST', `${table}/query/count`, { workspaceId: ws(), predicate: guess }),
+      ]
+      for (const read of refused) {
+        expect(read.status).toBe(403)
+        expect(read.body).not.toContain(CANARY.unknown)
+        expect(read.body).not.toContain(CANARY.secret)
+      }
+      /** The same predicate reads nothing but row ids, so it stays available. */
+      const byId = await cli('POST', `${table}/query`, {
         workspaceId: ws(),
-        q: 'second',
+        predicate: { field: 'id', op: 'in', value: [fixture.table.rows.clean] },
       })
-      expect(read.status).toBe(200)
-      const rows = new Set(
-        JSON.parse(read.body).data.matches.map((match: { rowId: string }) => match.rowId)
-      )
-      expect(rows).toEqual(new Set([fixture.table.rows.clean]))
+      expect(byId.status).toBe(200)
+      expect(modelView(byId)).toContain(CANARY.clean)
+    })
+
+    it('runs predicates over a table whose every cell is vouched for', async () => {
+      const created = await cli('POST', '/api/v2/tables', {
+        workspaceId: ws(),
+        name: `clean_${generateId().slice(0, 8)}`,
+        schema: { columns: [{ name: 'note', type: 'string' }] },
+      })
+      expect(created.status).toBe(201)
+      const table = `/api/v2/tables/${JSON.parse(created.body).data.id}`
+      for (const note of ['alpha second', 'beta']) {
+        expect(
+          (await cli('POST', `${table}/rows`, { workspaceId: ws(), data: { note } })).status
+        ).toBe(201)
+      }
+      const guess = { field: 'note', op: 'contains', value: 'second' }
+      const search = await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' })
+      expect(search.status).toBe(200)
+      expect(JSON.parse(search.body).data.matches).toHaveLength(1)
+      const query = await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess })
+      expect(query.status).toBe(200)
+      expect(modelView(query)).toContain('alpha second')
+      const count = await cli('POST', `${table}/query/count`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(count.status).toBe(200)
+
+      /** A sidecar that claims exact but holds no valid entry list vouches for nothing. */
+      const malformed = await cli('POST', `${table}/rows`, {
+        workspaceId: ws(),
+        data: { note: 'gamma' },
+      })
+      await db
+        .update(userTableRowSecretProvenance)
+        .set({ entries: sql`'{"not":"a list"}'::jsonb` })
+        .where(eq(userTableRowSecretProvenance.rowId, JSON.parse(malformed.body).data.id))
+      const afterCorruption = await cli('POST', `${table}/query`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(afterCorruption.status).toBe(403)
     })
 
     it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 3255694d432..414cd3dd574 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -1261,12 +1261,22 @@ async function resolveTableSelectionResource(
 
   const rendered = `${describe(sizeClause(lines.length, selectedRowCount - lines.length))}${lines.join('\n')}`
   const projected = projectResolvedSecretModelContent(rendered, selectionRegistry)
+  /** A fallback names the table, which is redacted like the rest; unredactable, it is omitted. */
+  const fallback = (reason: string) => {
+    const named = `Selected ${scope} from table ${JSON.stringify(table.name)} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+    const projectedName = projectResolvedSecretModelContent(named, selectionRegistry)
+    return projectedName.safe && typeof projectedName.value === 'string'
+      ? projectedName.value
+      : `Selected ${scope} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+  }
   const preview =
     !cellsProjected || !projected.safe || typeof projected.value !== 'string'
-      ? `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). Cell values could not be checked for secret values, so none were inlined.`
+      ? fallback('Cell values could not be checked for secret values, so none were inlined.')
       : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
         ? `${projected.value}${omittedNote}`
-        : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
+        : fallback(
+            'The column headings exceed the selection content limit; no cell values were inlined.'
+          )
   /** The descriptor names columns and rows; it is shown to the model too, so it is redacted too. */
   const projectedSelection = projectResolvedSecretModelContent(selection, selectionRegistry)
   const descriptor =
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index e98b5bb061a..dfafa9eadad 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -20,7 +20,7 @@ import {
 } from '@sim/testing/mocks/table-rows-service.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { TableDefinition } from '@/lib/table/types'
+import type { TableDefinition, TablePredicate } from '@/lib/table/types'
 
 const {
   mockIsScopeCompatible,
@@ -29,9 +29,9 @@ const {
   mockRowProvenance,
   mockFindRowMatches,
   mockClassifyColumns,
-  mockTableHasUnvouchedRows,
+  mockTableHasCellsUnsafe,
 } = vi.hoisted(() => ({
-  mockTableHasUnvouchedRows: vi.fn(),
+  mockTableHasCellsUnsafe: vi.fn(),
   mockFindRowMatches: vi.fn(),
   mockClassifyColumns: vi.fn(),
   mockIsScopeCompatible: vi.fn(),
@@ -60,7 +60,7 @@ vi.mock('@/lib/table/column-types', () => ({
 vi.mock('@/lib/table/rows/secret-provenance', () => ({
   ...tableRowsSecretProvenanceMock,
   classifyStoredTableRowColumns: mockClassifyColumns,
-  tableHasUnvouchedRows: mockTableHasUnvouchedRows,
+  tableHasCellsUnsafeForPredicate: mockTableHasCellsUnsafe,
   TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
     rowProvenance(rowId: string) {
       return mockRowProvenance(rowId)
@@ -997,54 +997,86 @@ describe('row delivery to Chat', () => {
     }
   )
 
-  describe('query counts Chat sees', () => {
-    const filtered = (principal: Caller) =>
+  describe('predicates Chat runs over cell values', () => {
+    const query = (principal: Caller, predicate?: TablePredicate) =>
       queryTableRows.execute({
         principal,
-        input: {
-          tableId: TABLE.id,
-          limit: 25,
-          includeTotal: true,
-          predicate: { all: [{ field: 'name', op: 'eq', value: 'guess' }] },
-        },
+        input: { tableId: TABLE.id, limit: 25, includeTotal: true, predicate },
       })
+    const BY_NAME: TablePredicate = { all: [{ field: 'name', op: 'eq', value: 'guess' }] }
 
     beforeEach(() => {
       mockQueryRows.mockResolvedValue({ ...PAGE, rowCount: 1, totalCount: 3 })
+      mockTableHasCellsUnsafe.mockResolvedValue(false)
     })
 
     it('counts only the rows delivered on the page', async () => {
       mockRowProvenance.mockReturnValue({ status: 'unknown' })
-      mockTableHasUnvouchedRows.mockResolvedValue(false)
-      const result = await observeContentDelivery({ admit: gate(false) }, () => filtered(CHAT))
+      const result = await observeContentDelivery({ admit: gate(false) }, () =>
+        query(CHAT, BY_NAME)
+      )
       expect(result).toMatchObject({ rows: [], rowCount: 0, totalCount: 3 })
     })
 
-    it('refuses a filtered total over a table holding rows Chat may not read', async () => {
+    it('refuses a predicate over cells it cannot vouch for, before running it', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, new Set(['column-name']))
+      expect(mockQueryRows).not.toHaveBeenCalled()
+    })
+
+    it('refuses when a cell it reads becomes unsafe during the read', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValueOnce(false).mockResolvedValueOnce(true)
       mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      mockTableHasUnvouchedRows.mockResolvedValue(true)
       await expect(
-        observeContentDelivery({ admit: gate(true) }, () => filtered(CHAT))
+        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
       ).rejects.toBeInstanceOf(ContentRefusedError)
     })
 
-    it('keeps an unfiltered total, which says only how many rows exist', async () => {
+    it('checks nothing for an id-only predicate or no predicate, which read no cell', async () => {
       mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      mockTableHasUnvouchedRows.mockResolvedValue(true)
-      const result = await observeContentDelivery({ admit: gate(true) }, () =>
-        queryTableRows.execute({
-          principal: CHAT,
-          input: { tableId: TABLE.id, limit: 25, includeTotal: true },
-        })
+      await observeContentDelivery({ admit: gate(true) }, () => query(CHAT))
+      await observeContentDelivery({ admit: gate(true) }, () =>
+        query(CHAT, { all: [{ field: 'id', op: 'in', value: ['row-1'] }] })
       )
-      expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
-      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
+    })
+
+    it('refuses a free-text search over a table with any unsafe cell', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () =>
+          searchTableRows.execute({ principal: CHAT, input: { tableId: TABLE.id, q: 'guess' } })
+        )
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, 'all')
+      expect(mockFindRowMatches).not.toHaveBeenCalled()
+    })
+
+    it('refuses an update by filter over unsafe cells before changing anything', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () =>
+          updateTableRows.execute({
+            principal: CHAT,
+            input: {
+              tableId: TABLE.id,
+              filter: { name: 'guess' },
+              data: { name: 'x' },
+              dataKeying: 'names',
+            },
+          })
+        )
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockUpdateRowsByFilter).not.toHaveBeenCalled()
     })
 
-    it('answers a person with the stored counts, unread', async () => {
-      const result = await filtered(PRINCIPAL)
+    it('answers a person with the stored counts, unchecked', async () => {
+      const result = await query(PRINCIPAL, BY_NAME)
       expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
-      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
     })
   })
 
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index 893371749e1..f9ee110254e 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -23,6 +23,7 @@ import type {
   BulkOperationResult,
   EnrichmentRunDetail,
   Filter,
+  PredicateNode,
   ReplaceRowsResult,
   RowData,
   RowExecutionMetadata,
@@ -94,7 +95,7 @@ import {
   createTableRowSecretProvenanceFromRegistry,
   createUnknownTableRowSecretProvenance,
   TableRowProvenanceReader,
-  tableHasUnvouchedRows,
+  tableHasCellsUnsafeForPredicate,
 } from '@/lib/table/rows/secret-provenance'
 import type { FindRowMatch, RowWriteOptions } from '@/lib/table/rows/service'
 import { replaceTableRowsWithTx } from '@/lib/table/rows/service'
@@ -566,26 +567,62 @@ export interface QueryTableRowsResult extends TableResult {
 }
 
 /**
- * The counts a query reports, as Chat may see them. The page's count is always the rows delivered.
- * A filtered total also counts rows Chat may not read, which would answer the filter's question
- * about their text, so Chat gets it only when every row of the table can be vouched for; otherwise
- * the count is refused. An unfiltered total says only how many rows exist. Other callers are
- * unchanged.
+ * The schema columns whose cells a predicate, filter or sort reads (storage ids). A field that is
+ * not a schema column, such as the row id, reads no cell.
  */
-async function countsForReader(
+function cellColumnsRead(
+  table: TableDefinition,
+  query: { predicate?: TablePredicate; filter?: Filter; sort?: Sort }
+): Set<string> {
+  const schemaColumns = new Set(table.schema.columns.map(getColumnId))
+  const read = new Set<string>()
+  const note = (field: string) => {
+    if (schemaColumns.has(field)) read.add(field)
+  }
+  const walkPredicate = (node: PredicateNode): void => {
+    if ('field' in node) note(node.field)
+    else for (const child of 'all' in node ? node.all : node.any) walkPredicate(child)
+  }
+  const walkFilter = (filter: Filter): void => {
+    for (const [key, value] of Object.entries(filter)) {
+      if ((key === '$or' || key === '$and') && Array.isArray(value)) {
+        for (const child of value) walkFilter(child as Filter)
+      } else note(key)
+    }
+  }
+  if (query.predicate) walkPredicate(query.predicate)
+  if (query.filter) walkFilter(query.filter)
+  for (const field of Object.keys(query.sort ?? {})) note(field)
+  return read
+}
+
+/**
+ * Runs a read whose rows, counts or page boundaries depend on cell values, for Chat only over a
+ * table where those cells are all vouched for (see `tableHasCellsUnsafeForPredicate`). The check
+ * runs before and after the read, so a row that becomes unsafe meanwhile refuses it too; a row
+ * unsafe only between the two checks is the residual. Other callers read with no check.
+ */
+async function requireCellsSafeForPredicate(
   principal: Principal,
   tableId: string,
-  result: Pick<QueryTableRowsResult, 'rowCount' | 'totalCount'>,
-  delivered: readonly unknown[],
-  query: { filtered: boolean }
-): Promise<Pick<QueryTableRowsResult, 'rowCount' | 'totalCount'>> {
-  if (!isCopilotPrincipal(principal)) {
-    return { rowCount: result.rowCount, totalCount: result.totalCount }
-  }
-  if (result.totalCount !== null && query.filtered && (await tableHasUnvouchedRows(tableId))) {
+  columns: ReadonlySet<string> | 'all'
+): Promise<void> {
+  if (!isCopilotPrincipal(principal) || (columns !== 'all' && columns.size === 0)) return
+  if (await tableHasCellsUnsafeForPredicate(tableId, columns)) {
     throw new ContentRefusedError('table-row')
   }
-  return { rowCount: delivered.length, totalCount: result.totalCount }
+}
+
+async function readUnderCellPredicate<T>(
+  principal: Principal,
+  tableId: string,
+  columns: ReadonlySet<string> | 'all',
+  read: () => Promise<T>
+): Promise<T> {
+  await requireCellsSafeForPredicate(principal, tableId, columns)
+  const result = await read()
+  await requireCellsSafeForPredicate(principal, tableId, columns)
+  return result
 }
 
 export const queryTableRows = defineAuthorizedTableUseCase({
@@ -658,30 +695,35 @@ export const queryTableRows = defineAuthorizedTableUseCase({
           if (column) columnIds.add(getColumnId(column))
         }
       }
-      const result = await queryRows(
-        context.table,
-        {
-          predicate,
-          filter: legacyFilter,
-          sort,
-          limit: input.limit,
-          after: cursor?.after ?? input.after,
-          offset: cursor?.offset ?? input.offset,
-          includeTotal: input.includeTotal ?? false,
-          withExecutions: input.includeRunState ?? false,
-          runStateBudgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
-          columnIds,
-        },
-        requestId(input),
-        readProvenance
+      const result = await readUnderCellPredicate(
+        principal,
+        context.table.id,
+        cellColumnsRead(context.table, { predicate, filter: legacyFilter, sort }),
+        () =>
+          queryRows(
+            context.table,
+            {
+              predicate,
+              filter: legacyFilter,
+              sort,
+              limit: input.limit,
+              after: cursor?.after ?? input.after,
+              offset: cursor?.offset ?? input.offset,
+              includeTotal: input.includeTotal ?? false,
+              withExecutions: input.includeRunState ?? false,
+              runStateBudgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
+              columnIds,
+            },
+            requestId(input),
+            readProvenance
+          )
       )
       const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
         ...result,
-        ...(await countsForReader(principal, context.table.id, result, rows, {
-          filtered: Boolean(predicate || legacyFilter),
-        })),
+        /** Chat's page count is what it was delivered; totals are safe once the read was allowed. */
+        rowCount: isCopilotPrincipal(principal) ? rows.length : result.rowCount,
         rows: rowsForReader(principal, rows),
         ...(input.includePersistedSecretProvenance && readProvenance
           ? { secretProvenance: readProvenance.exportProvenance() }
@@ -765,10 +807,9 @@ export const searchTableRows = defineAuthorizedTableUseCase({
         const translated = sortSpecNamesToIds(input.sort, buildIdByName(context.table.schema))
         sort = Object.fromEntries(translated.map((item) => [item.field, item.direction]))
       }
-      const result = await findRowMatches(
-        context.table,
-        { q: input.q, filter, sort },
-        requestId(input)
+      /** Free text is matched against every column, so every column's cells are read. */
+      const result = await readUnderCellPredicate(principal, context.table.id, 'all', () =>
+        findRowMatches(context.table, { q: input.q, filter, sort }, requestId(input))
       )
       const matches = await admitRowMatches(principal, result.matches, result.revisions)
       return {
@@ -1447,10 +1488,21 @@ export const updateTableRows = defineAuthorizedTableUseCase({
         input,
         storageData: data,
       })
+      const filter = tableFilterToStorage(
+        input.filter,
+        context.table,
+        input.filterKeying ?? 'names'
+      )
+      /** The affected count answers the filter's question, so Chat filters only vouched cells. */
+      await requireCellsSafeForPredicate(
+        principal,
+        context.table.id,
+        cellColumnsRead(context.table, { filter })
+      )
       const result = await updateRowsByFilter(
         context.table,
         {
-          filter: tableFilterToStorage(input.filter, context.table, input.filterKeying ?? 'names'),
+          filter,
           data,
           limit: input.limit,
           actorUserId: actorUserId(principal, context.billedAccountUserId),
@@ -1633,7 +1685,7 @@ export type DeleteTableRowsResult = TableResult &
 export const deleteTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.deleteRows,
   resolveContext: ({ input }: { input: DeleteTableRowsInput }) => resolveActiveTableContext(input),
-  async execute({ input, context }): Promise<DeleteTableRowsResult> {
+  async execute({ principal, input, context }): Promise<DeleteTableRowsResult> {
     try {
       if (input.kind === 'ids') {
         if (input.rowIds.length < 1 || input.rowIds.length > TABLE_LIMITS.MAX_BULK_OPERATION_SIZE) {
@@ -1655,10 +1707,20 @@ export const deleteTableRows = defineAuthorizedTableUseCase({
       if (input.limit !== undefined) {
         requireIntegerInRange(input.limit, 1, TABLE_LIMITS.MAX_BULK_OPERATION_SIZE, 'Limit')
       }
+      const filter = tableFilterToStorage(
+        input.filter,
+        context.table,
+        input.filterKeying ?? 'names'
+      )
+      await requireCellsSafeForPredicate(
+        principal,
+        context.table.id,
+        cellColumnsRead(context.table, { filter })
+      )
       const result = await deleteRowsByFilter(
         context.table,
         {
-          filter: tableFilterToStorage(input.filter, context.table, input.filterKeying ?? 'names'),
+          filter,
           limit: input.limit,
         },
         requestId(input)
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index 717d4531207..33dbf64b9d8 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -947,14 +947,31 @@ async function classifyTableRowCrossings(
 }
 
 /**
- * Whether any row of a table cannot be vouched for: tracked, but with no current exact sidecar.
- * A count over a filter that such a row matches would answer a question about text Chat may not
- * read, so a Chat count is taken only over a table where every row can be vouched for.
+ * Whether a predicate over `columnIds` (every column, for `'all'`) could answer a question about
+ * text Chat may not read: some row of the table cannot be vouched for (tracked, with a missing,
+ * stale, non-exact or malformed sidecar), or some row records a secret in a column the predicate
+ * reads. A predicate's matches, counts and page boundaries all depend on such cells, so Chat runs
+ * one only over a table where none exist. The answer is the same whatever the predicate asks, so
+ * the refusal itself reveals nothing about any cell.
  */
-export async function tableHasUnvouchedRows(
+export async function tableHasCellsUnsafeForPredicate(
   tableId: string,
+  columnIds: ReadonlySet<string> | 'all',
   executor: DbExecutor = db
 ): Promise<boolean> {
+  const entries = sql`CASE WHEN jsonb_typeof(${userTableRowSecretProvenance.entries}) = 'array'
+    THEN ${userTableRowSecretProvenance.entries} ELSE '[]'::jsonb END`
+  const referenced =
+    columnIds === 'all'
+      ? sql`true`
+      : columnIds.size === 0
+        ? sql`false`
+        : sql`entry->>'columnId' IN (${sql.join(
+            [...columnIds].map((columnId) => sql`${columnId}`),
+            sql`, `
+          )})`
+  const optionalText = (key: string) =>
+    sql`(jsonb_exists(entry, ${key}) AND (jsonb_typeof(entry->${key}) IS DISTINCT FROM 'string' OR entry->>${key} = ''))`
   const [row] = await executor
     .select({ id: userTableRows.id })
     .from(userTableRows)
@@ -968,7 +985,28 @@ export async function tableHasUnvouchedRows(
         sql`${userTableRows.secretProvenanceVersion} IS NOT NULL`,
         sql`(${userTableRows.secretProvenanceVersion} <> ${TABLE_ROW_SECRET_PROVENANCE_VERSION}
           OR ${userTableRowSecretProvenance.status} IS DISTINCT FROM 'exact'
-          OR ${userTableRowSecretProvenance.contentUpdatedAt} IS DISTINCT FROM ${userTableRows.updatedAt})`
+          OR ${userTableRowSecretProvenance.contentUpdatedAt} IS DISTINCT FROM ${userTableRows.updatedAt}
+          OR jsonb_typeof(${userTableRowSecretProvenance.entries}) IS DISTINCT FROM 'array'
+          OR EXISTS (
+            SELECT 1 FROM jsonb_array_elements(${entries}) AS entry
+            WHERE CASE WHEN jsonb_typeof(entry) <> 'object' THEN true ELSE (
+              jsonb_typeof(entry->'columnId') IS DISTINCT FROM 'string'
+              OR entry->>'columnId' = ''
+              OR jsonb_typeof(entry->'encryptedValue') IS DISTINCT FROM 'string'
+              OR entry->>'encryptedValue' = ''
+              OR ${optionalText('name')}
+              OR ${optionalText('sourceUserId')}
+              OR ${optionalText('sourceWorkspaceId')}
+              OR EXISTS (
+                SELECT 1 FROM jsonb_object_keys(entry) AS key
+                WHERE key NOT IN (${sql.join(
+                  [...STORED_ENTRY_KEYS].map((key) => sql`${key}`),
+                  sql`, `
+                )})
+              )
+              OR ${referenced}
+            ) END
+          ))`
       )
     )
     .limit(1)
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
index d8e1a19a3d5..74bbb6a9fb4 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.test.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -168,6 +168,17 @@ describe('withholdUnadmittedInlineFiles', () => {
     expect(result.node.file).not.toHaveProperty('base64')
   })
 
+  it('withholds inline bytes even after a byteless descriptor of the same file', async () => {
+    const output = {
+      first: runFile('secret'),
+      later: runFile('secret', { base64: 'c2VjcmV0' }),
+    }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result.later).not.toHaveProperty('base64')
+  })
+
   it('keeps an own `__proto__` key as data in the copy', async () => {
     const output = JSON.parse('{"__proto__":{"note":"kept"},"files":[]}')
     output.files.push(runFile('secret', { base64: 'c2VjcmV0' }))
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
index 7afb1b564a6..7514a717d58 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -6,7 +6,7 @@ import {
   type ContentView,
   isCopilotPrincipal,
 } from '@/lib/core/application/content-delivery'
-import { collectUserFilesById, isUserFileWithMetadata } from '@/lib/core/utils/user-file'
+import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import type { UserFile } from '@/executor/types'
 
@@ -14,13 +14,14 @@ import type { UserFile } from '@/executor/types'
  * Admits each file a run produced on its own, classified by the storage key the run recorded, and
  * returns the ids admitted. A caller no gate observes gets every id back without a provenance read.
  */
-export async function admitRunFiles(
+/** Admits each run file on its own; see {@link admitRunFiles}. Returns the admitted files. */
+async function admitRunFileItems(
   principal: Principal,
   workspaceId: string,
   files: readonly UserFile[],
   view: ContentView
-): Promise<Set<string>> {
-  const admitted = await admitEach(principal, files, async (items) => {
+): Promise<UserFile[]> {
+  return admitEach(principal, files, async (items) => {
     const provenance = await getStoredFileSecretProvenanceByKey(
       workspaceId,
       items.map((file) => file.key)
@@ -35,9 +36,34 @@ export async function admitRunFiles(
       view,
     }))
   })
+}
+
+export async function admitRunFiles(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly UserFile[],
+  view: ContentView
+): Promise<Set<string>> {
+  const admitted = await admitRunFileItems(principal, workspaceId, files, view)
   return new Set(admitted.map((file) => file.id))
 }
 
+/**
+ * Every file descriptor in an output that inlines bytes, once per storage key. Not deduplicated by
+ * id: an earlier descriptor of the same file without bytes must not hide a later one with them.
+ */
+function collectInlinedFiles(value: unknown, files: Map<string, UserFile>, seen: WeakSet<object>) {
+  if (!value || typeof value !== 'object' || seen.has(value)) return
+  seen.add(value)
+  if (isUserFileWithMetadata(value)) {
+    if (typeof value.base64 === 'string' && !files.has(value.key)) files.set(value.key, value)
+    return
+  }
+  for (const item of Array.isArray(value) ? value : Object.values(value)) {
+    collectInlinedFiles(item, files, seen)
+  }
+}
+
 function withoutUnadmittedBase64(
   value: unknown,
   admittedKeys: ReadonlySet<string>,
@@ -66,8 +92,10 @@ function withoutUnadmittedBase64(
    */
   const prototype = Object.getPrototypeOf(value)
   if (prototype !== Object.prototype && prototype !== null) {
-    for (const file of collectUserFilesById(value).values()) {
-      if (typeof file.base64 === 'string' && !admittedKeys.has(file.key)) {
+    const held = new Map<string, UserFile>()
+    collectInlinedFiles(value, held, new WeakSet())
+    for (const file of held.values()) {
+      if (!admittedKeys.has(file.key)) {
         throw new ContentRefusedError('execution-file')
       }
     }
@@ -102,14 +130,12 @@ export async function withholdUnadmittedInlineFiles<T>(
     await admitContent(principal, [])
     return value
   }
-  const inlined = [...collectUserFilesById(value).values()].filter(
-    (file) => typeof file.base64 === 'string'
-  )
-  const admittedIds = await admitRunFiles(principal, workspaceId, inlined, 'opaque')
-  if (admittedIds.size === inlined.length) return value
-  const admittedKeys = new Set(
-    inlined.filter((file) => admittedIds.has(file.id)).map((file) => file.key)
-  )
+  const found = new Map<string, UserFile>()
+  collectInlinedFiles(value, found, new WeakSet())
+  const inlined = [...found.values()]
+  const admitted = await admitRunFileItems(principal, workspaceId, inlined, 'opaque')
+  if (admitted.length === inlined.length) return value
+  const admittedKeys = new Set(admitted.map((file) => file.key))
   return withoutUnadmittedBase64(value, admittedKeys, new WeakMap()) as T
 }
 

From dee7a0847f421632c91fa8def7d7e6ab98871774 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 13:39:17 -0700
Subject: [PATCH 06/13] fix(mothership): keep content delivery scoped and
 consistent

---
 .claude/rules/sim-content-delivery.md         |  31 +-
 .cursor/rules/sim-content-delivery.mdc        |  31 +-
 .../api/v2/files/bulk-download/route.test.ts  |   1 +
 .../app/api/v2/files/bulk-download/route.ts   |  15 +-
 .../utils/resolved-secret-trace-registry.ts   |  65 ++-
 .../server/routes/copilot-content-routes.json |  12 +-
 .../server/routes/copilot-refused-routes.json |   5 -
 .../routes/copilot-route-inventory.test.ts    |  16 +-
 .../core/application/content-delivery.test.ts | 179 +++++--
 .../lib/core/application/content-delivery.ts  |  66 ++-
 .../core/application/workspace-operation.ts   |  10 +-
 .../durable-secret-provenance-telemetry.ts    |   8 +-
 .../execution/durable-secret-provenance.ts    | 101 +---
 apps/sim/lib/execution/provenance-entries.ts  |  78 +++
 .../content-reads.integration.ts              | 231 +++++++++
 .../sandbox/brokers/workspace-file.ts         |  28 +-
 apps/sim/lib/execution/sandbox/run-task.ts    |  10 +-
 apps/sim/lib/execution/sandbox/types.ts       |   9 +-
 .../content-delivery.integration.ts           | 465 ++++++++++++++++++
 .../application/admit-knowledge-content.ts    |  15 +-
 .../lib/knowledge/application/chunks.test.ts  |  56 +--
 apps/sim/lib/knowledge/application/chunks.ts  |  19 +-
 .../knowledge/application/connectors.test.ts  |  36 +-
 .../lib/knowledge/application/connectors.ts   |   8 +-
 .../knowledge/application/documents.test.ts   |  43 --
 .../lib/knowledge/application/documents.ts    |  14 +-
 apps/sim/lib/knowledge/application/exports.ts |  91 +++-
 .../lib/knowledge/application/operations.ts   |  13 +-
 .../lib/knowledge/application/tags.test.ts    | 168 +++----
 apps/sim/lib/knowledge/application/tags.ts    |  53 +-
 apps/sim/lib/knowledge/secret-provenance.ts   |  90 +++-
 .../knowledge/transfer/export-archive.test.ts |   5 +
 .../lib/knowledge/transfer/export-archive.ts  |  10 +-
 .../lib/knowledge/transfer/export-source.ts   |   7 +-
 .../lib/media/ffmpeg-content.integration.ts   | 248 ++++++++++
 .../content-delivery-fixture.ts               |   3 +-
 .../content-delivery.integration.ts           | 210 +++++++-
 .../agent-cli/saved-run-read.live.test.ts     | 102 ++--
 .../mothership/chat/process-contents.test.ts  |  75 ++-
 .../content-delivery/registry-gate.test.ts    |  42 ++
 .../content-delivery/registry-gate.ts         |  15 +-
 .../mothership/content-delivery/telemetry.ts  |   7 +
 .../function-execute-file-mounts.test.ts      |   6 +-
 .../function-execute-table-mounts.test.ts     |  10 +-
 .../tools/handlers/function-execute.ts        |  20 +-
 .../workbench-confidentiality.live.test.ts    |  42 +-
 .../tools/sandbox-resource-transport.ts       |   5 +-
 .../tools/server/files/doc-compile.ts         |  52 +-
 .../tools/server/media/ffmpeg.test.ts         |  18 +-
 .../mothership/tools/server/media/ffmpeg.ts   |  27 +-
 apps/sim/lib/table/application/operations.ts  |   2 +-
 apps/sim/lib/table/application/rows.test.ts   | 199 +-------
 apps/sim/lib/table/application/rows.ts        | 184 +------
 .../table/import-provenance.integration.ts    | 187 +++++++
 apps/sim/lib/table/import-provenance.ts       |  40 +-
 .../lib/table/rows/secret-provenance.test.ts  |  44 --
 apps/sim/lib/table/rows/secret-provenance.ts  | 121 -----
 apps/sim/lib/table/rows/service.ts            |  18 +-
 .../application/execute-tool.test.ts          |  28 --
 .../application/execute-tool.ts               |  36 +-
 .../tool-execution/application/operations.ts  |   2 +-
 .../file-versions.integration.ts              |  10 +-
 .../workspace-file-secret-provenance.ts       |  13 +-
 .../application/admit-run-files.test.ts       |  37 +-
 .../workflows/application/admit-run-files.ts  | 125 +++--
 .../download-workspace-file-items.test.ts     |  29 +-
 .../download-workspace-file-items.ts          |   3 +
 .../read-workspace-file-content.ts            |  28 +-
 .../search-workspace-file-content.test.ts     |  39 +-
 .../search-workspace-file-content.ts          |  32 +-
 apps/sim/tools/index.ts                       |   8 -
 packages/testing/src/mocks/tools.mock.ts      |   3 -
 scripts/check-test-types.baseline.json        |  16 -
 73 files changed, 2606 insertions(+), 1469 deletions(-)
 create mode 100644 apps/sim/lib/execution/provenance-entries.ts
 create mode 100644 apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
 create mode 100644 apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
 create mode 100644 apps/sim/lib/media/ffmpeg-content.integration.ts
 create mode 100644 apps/sim/lib/table/import-provenance.integration.ts

diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
index 020f887bff7..e9dc5888411 100644
--- a/.claude/rules/sim-content-delivery.md
+++ b/.claude/rules/sim-content-delivery.md
@@ -20,7 +20,9 @@ Content derived from a provenance-bearing store reaches Chat's model only after
 came from is admitted by the gate of the surface it leaves through. The stores are workspace files
 (and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
 bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
-error text that quotes content, public links, and match results.
+error text that quotes content, and public links. Counts, ordering, and match locations are ordinary
+metadata; this boundary protects supported literal secret values, not arbitrary inference. Intentional
+human uploads remain ordinary input and are not scanned.
 
 Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
 classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
@@ -33,6 +35,7 @@ the workflow executor see byte-identical results.
     single-item form and throws `ContentRefusedError` (403).
   - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
     does not undo the write: audit and effects run, then the operation answers with the refusal.
+    Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
     may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
     redaction reaches: binary, base64, archives, images, public links).
@@ -49,7 +52,7 @@ the workflow executor see byte-identical results.
 ## Rules
 
 1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
-   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   can carry content from a store, `'none'` otherwise. Definition throws
    without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
 2. **A `sourced` use case accounts for what it returns**, before it loads content: call
    `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
@@ -58,7 +61,7 @@ the workflow executor see byte-identical results.
    only when its items cannot be separated (one file, one render, one compile).
 4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
    `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
-   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+   Refresh the list with `vitest run lib/api/server/routes/copilot-route-inventory.test.ts --update=all`.
 5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
    Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
 
@@ -70,19 +73,27 @@ own unless noted.
 | Path | U | E | R / C |
 |---|---|---|---|
 | File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
-| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
+| Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
 | File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
-| Bulk download zip | Left out | Left out (opaque) | Included |
-| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| Bulk download zip | Left out, reported in the archive manifest | Left out (opaque), reported in the archive manifest | Included |
+| `files search` | Match location kept; clipped preview withheld | Same; read/grep provides safely redacted text | Returned |
 | File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
 | Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
 | Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
-| Doc compile | Compile refused | Error text redacted | Compiles |
+| Doc compile | Actual file read refused | Evidence imported before broker bytes/errors return | Compiles, including dynamic file references |
 | Run file download | 403 | Redacted | Delivered |
 | Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
 | KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
-| KB export, table export download | Not available to Chat | | |
+| KB export | Stream fails before refused source bytes; no successful archive receipt | Refused (opaque) | Streams originals/chunks with admission at each source |
+| Table export download | Existing unsupported Chat operation | | |
 | Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
-| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Row search | Locations returned without cell values | Same | Returned |
 | Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
-| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
+| `tools execute` | Settled result withheld, with no automatic retry | Named masking through the existing registry | Returned, subject to existing tool authorization |
+
+Search pagination and aggregate totals retain their database meaning even when an item or preview is
+withheld. Do not scan unrelated table rows or whole document collections to conceal counts.
+A refused requested mount stops code before it runs, avoiding an older file at the same sandbox path.
+Registry admission commits only when the complete item fits the existing capacity; a refused item
+must not consume capacity or permanently disable the parent registry.
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
index df08f58f731..fc8405caab3 100644
--- a/.cursor/rules/sim-content-delivery.mdc
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -11,7 +11,9 @@ Content derived from a provenance-bearing store reaches Chat's model only after
 came from is admitted by the gate of the surface it leaves through. The stores are workspace files
 (and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
 bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
-error text that quotes content, public links, and match results.
+error text that quotes content, and public links. Counts, ordering, and match locations are ordinary
+metadata; this boundary protects supported literal secret values, not arbitrary inference. Intentional
+human uploads remain ordinary input and are not scanned.
 
 Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
 classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
@@ -24,6 +26,7 @@ the workflow executor see byte-identical results.
     single-item form and throws `ContentRefusedError` (403).
   - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
     does not undo the write: audit and effects run, then the operation answers with the refusal.
+    Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
     may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
     redaction reaches: binary, base64, archives, images, public links).
@@ -40,7 +43,7 @@ the workflow executor see byte-identical results.
 ## Rules
 
 1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
-   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   can carry content from a store, `'none'` otherwise. Definition throws
    without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
 2. **A `sourced` use case accounts for what it returns**, before it loads content: call
    `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
@@ -49,7 +52,7 @@ the workflow executor see byte-identical results.
    only when its items cannot be separated (one file, one render, one compile).
 4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
    `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
-   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+   Refresh the list with `vitest run lib/api/server/routes/copilot-route-inventory.test.ts --update=all`.
 5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
    Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
 
@@ -61,19 +64,27 @@ own unless noted.
 | Path | U | E | R / C |
 |---|---|---|---|
 | File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
-| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
+| Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
 | File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
-| Bulk download zip | Left out | Left out (opaque) | Included |
-| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| Bulk download zip | Left out, reported in the archive manifest | Left out (opaque), reported in the archive manifest | Included |
+| `files search` | Match location kept; clipped preview withheld | Same; read/grep provides safely redacted text | Returned |
 | File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
 | Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
 | Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
-| Doc compile | Compile refused | Error text redacted | Compiles |
+| Doc compile | Actual file read refused | Evidence imported before broker bytes/errors return | Compiles, including dynamic file references |
 | Run file download | 403 | Redacted | Delivered |
 | Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
 | KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
-| KB export, table export download | Not available to Chat | | |
+| KB export | Stream fails before refused source bytes; no successful archive receipt | Refused (opaque) | Streams originals/chunks with admission at each source |
+| Table export download | Existing unsupported Chat operation | | |
 | Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
-| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Row search | Locations returned without cell values | Same | Returned |
 | Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
-| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |
+| `tools execute` | Settled result withheld, with no automatic retry | Named masking through the existing registry | Returned, subject to existing tool authorization |
+
+Search pagination and aggregate totals retain their database meaning even when an item or preview is
+withheld. Do not scan unrelated table rows or whole document collections to conceal counts.
+A refused requested mount stops code before it runs, avoiding an older file at the same sandbox path.
+Registry admission commits only when the complete item fits the existing capacity; a refused item
+must not consume capacity or permanently disable the parent registry.
diff --git a/apps/sim/app/api/v2/files/bulk-download/route.test.ts b/apps/sim/app/api/v2/files/bulk-download/route.test.ts
index 2e98a0b3ce5..b2352f3c29b 100644
--- a/apps/sim/app/api/v2/files/bulk-download/route.test.ts
+++ b/apps/sim/app/api/v2/files/bulk-download/route.test.ts
@@ -76,6 +76,7 @@ describe('GET /api/v2/files/bulk-download', () => {
       folderPaths: new Map<string, string>(),
       renderedDocuments: new Map<string, Buffer>(),
       declaredBytes: 6,
+      excludedFileIds: [],
     })
   })
 
diff --git a/apps/sim/app/api/v2/files/bulk-download/route.ts b/apps/sim/app/api/v2/files/bulk-download/route.ts
index f2322d778ce..5587caa1a16 100644
--- a/apps/sim/app/api/v2/files/bulk-download/route.ts
+++ b/apps/sim/app/api/v2/files/bulk-download/route.ts
@@ -54,14 +54,16 @@ export const GET = defineV2BinaryRoute({
     folderPaths: query.folderPaths,
   }),
   useCase: downloadWorkspaceFileItems,
-  present: ({ filesToZip, folderPaths, renderedDocuments }) => {
-    const entryPaths = buildZipEntryPaths(
-      filesToZip.map((file) => ({
+  present: ({ filesToZip, folderPaths, renderedDocuments, excludedFileIds }) => {
+    const report = excludedFileIds.length > 0 ? { partial: true, excludedFileIds } : undefined
+    const entryPaths = buildZipEntryPaths([
+      ...filesToZip.map((file) => ({
         name: file.name,
         folderPath: file.folderId ? folderPaths.get(file.folderId) : null,
         contentType: file.type,
-      }))
-    )
+      })),
+      ...(report ? [{ name: 'sim-download-report.json', contentType: 'application/json' }] : []),
+    ])
     const archive = new ZipArchive({ store: true })
     archive.on('warning', (error: Error) => {
       logger.warn('Archive warning while streaming workspace files', { error })
@@ -71,6 +73,9 @@ export const GET = defineV2BinaryRoute({
         name: entryPaths[index],
       })
     })
+    if (report) {
+      archive.append(JSON.stringify(report, null, 2), { name: entryPaths[filesToZip.length] })
+    }
     archive.finalize().catch((error) => {
       logger.error('Failed to finalize workspace file archive', { error })
     })
diff --git a/apps/sim/executor/utils/resolved-secret-trace-registry.ts b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
index e9158202c07..d5408ec0d88 100644
--- a/apps/sim/executor/utils/resolved-secret-trace-registry.ts
+++ b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
@@ -1731,6 +1731,41 @@ export class ResolvedSecretTraceRegistry {
     return importedAll
   }
 
+  /** Imports one item's trusted evidence atomically, leaving this registry unchanged on refusal. */
+  async tryImportProvenance(
+    provenances: Iterable<ResolvedSecretTraceProvenanceV1>,
+    options: ImportResolvedSecretTraceProvenanceOptions & { value?: unknown }
+  ): Promise<boolean> {
+    const staged = new ResolvedSecretTraceRegistry([], this.scope, { staged: true })
+    for (const provenance of provenances) {
+      if (!(await staged.importProvenance(provenance, options)) || !staged.isComplete())
+        return false
+    }
+
+    let entries = [...staged.activeEntries.values()]
+    if (options.value !== undefined) {
+      const filtered = staged.exportProvenanceForValue(options.value)
+      if (!filtered.complete) return false
+      const selected = new Set(
+        filtered.entries.map((entry) =>
+          activeEntryKey({
+            name: entry.name ?? '',
+            plaintext: '',
+            encryptedValue: entry.encryptedValue,
+            anonymous: entry.name === undefined,
+          })
+        )
+      )
+      entries = entries.filter((entry) => selected.has(activeEntryKey(entry)))
+    }
+
+    /** No await separates the capacity check from activation, including across concurrent calls. */
+    if (this.isPermanentlyIncomplete() || this.activeEntryBytesAfter(entries) === undefined)
+      return false
+    for (const entry of entries) this.addActiveEntry(entry, { propagated: true })
+    return true
+  }
+
   /**
    * Imports only provenance whose decrypted plaintext occurs in the exact value crossing this
    * boundary. Staging in a scoped temporary registry prevents a valid but overbroad envelope from
@@ -2578,6 +2613,22 @@ export class ResolvedSecretTraceRegistry {
     if (copied) target.inheritIncompletenessReasonsFrom(this)
   }
 
+  private activeEntryBytesAfter(entries: Iterable<ActiveSecretEntry>): number | undefined {
+    let count = this.activeEntries.size
+    let bytes = this.activeProvenanceEntryBytes
+    for (const entry of entries) {
+      if (this.activeEntries.has(activeEntryKey(entry))) continue
+      bytes += (count === 0 ? 0 : 1) + serializedProvenanceEntryByteSize(toProvenanceEntry(entry))
+      count += 1
+      if (
+        count > MAX_PROVENANCE_ENTRIES ||
+        this.completeProvenanceEnvelopeBytes + bytes > MAX_SERIALIZED_PROVENANCE_BYTES
+      )
+        return undefined
+    }
+    return bytes
+  }
+
   private addActiveEntry(entry: ActiveSecretEntry, options: { propagated?: boolean } = {}): void {
     const key = activeEntryKey(entry)
     const existing = this.activeEntries.get(key)
@@ -2596,22 +2647,14 @@ export class ResolvedSecretTraceRegistry {
       return
     }
 
-    const entryBytes = serializedProvenanceEntryByteSize(toProvenanceEntry(entry))
-    const separatorBytes = this.activeEntries.size === 0 ? 0 : 1
-    if (
-      this.activeEntries.size >= MAX_PROVENANCE_ENTRIES ||
-      this.completeProvenanceEnvelopeBytes +
-        this.activeProvenanceEntryBytes +
-        separatorBytes +
-        entryBytes >
-        MAX_SERIALIZED_PROVENANCE_BYTES
-    ) {
+    const nextEntryBytes = this.activeEntryBytesAfter([entry])
+    if (nextEntryBytes === undefined) {
       this.markIncomplete('provenance-capacity-exceeded')
       return
     }
     this.activeEntries.set(key, entry)
     if (options.propagated) this.propagatedEntryKeys.add(key)
-    this.activeProvenanceEntryBytes += separatorBytes + entryBytes
+    this.activeProvenanceEntryBytes = nextEntryBytes
     this.modelEgressRevision += 1
   }
 
diff --git a/apps/sim/lib/api/server/routes/copilot-content-routes.json b/apps/sim/lib/api/server/routes/copilot-content-routes.json
index 530c83f405f..59666a8fdb6 100644
--- a/apps/sim/lib/api/server/routes/copilot-content-routes.json
+++ b/apps/sim/lib/api/server/routes/copilot-content-routes.json
@@ -86,8 +86,8 @@
   },
   {
     "method": "GET",
-    "path": "/api/v2/knowledge/[knowledgeBaseId]/tags/usage",
-    "operation": "knowledge.tags.read_usage"
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/export",
+    "operation": "knowledge.export"
   },
   {
     "method": "POST",
@@ -131,13 +131,13 @@
   },
   {
     "method": "POST",
-    "path": "/api/v2/tables/[tableId]/rows/search",
-    "operation": "tables.rows.search"
+    "path": "/api/v2/tables/[tableId]/rows/upsert",
+    "operation": "tables.rows.upsert"
   },
   {
     "method": "POST",
-    "path": "/api/v2/tables/[tableId]/rows/upsert",
-    "operation": "tables.rows.upsert"
+    "path": "/api/v2/tools/[toolId]/execute",
+    "operation": "tools.execute"
   },
   {
     "method": "POST",
diff --git a/apps/sim/lib/api/server/routes/copilot-refused-routes.json b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
index 58731b33a67..2cc89d250fa 100644
--- a/apps/sim/lib/api/server/routes/copilot-refused-routes.json
+++ b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
@@ -14,11 +14,6 @@
     "path": "/api/v2/files/[fileId]/versions/[version]/content",
     "operation": "files.versions.download"
   },
-  {
-    "method": "GET",
-    "path": "/api/v2/knowledge/[knowledgeBaseId]/export",
-    "operation": "knowledge.export"
-  },
   {
     "method": "GET",
     "path": "/api/v2/meta",
diff --git a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
index 739dc633fbe..b29ca9fa233 100644
--- a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
+++ b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
@@ -11,8 +11,8 @@ const inventory = vi.hoisted(
     [] as Array<{
       method: string
       path: string
-      operation: ApplicationOperation
-      useCase: CopilotRouteUseCase
+      operation: RouteOperation
+      useCase?: CopilotRouteUseCase
     }>
 )
 const built = vi.hoisted(() => new WeakSet<object>())
@@ -20,8 +20,8 @@ const builder = vi.hoisted(
   () =>
     (options: {
       contract: { method: string; path: string }
-      operation: ApplicationOperation
-      useCase: CopilotRouteUseCase
+      operation: RouteOperation
+      useCase?: CopilotRouteUseCase
     }) => {
       inventory.push({
         method: options.contract.method,
@@ -40,7 +40,7 @@ const recordAdmission = vi.hoisted(
   () =>
     async (
       _request: Request,
-      operation: ApplicationOperation,
+      operation: RouteOperation,
       _auth: unknown,
       _rateLimit: unknown,
       useCase?: CopilotRouteUseCase
@@ -71,6 +71,10 @@ import {
 } from '@/lib/api/server/routes/copilot-request'
 import { V2_ROUTES } from '@/lib/api/server/routes/v2-route-table.generated'
 import type { ApplicationOperation } from '@/lib/core/application/operation'
+import type { WorkspaceOperation } from '@/lib/core/application/workspace-operation'
+
+type RouteOperation = ApplicationOperation &
+  Pick<WorkspaceOperation, 'principalKinds' | 'delegatedServices'>
 
 /**
  * Routes Mothership refuses, judged by the rule admission itself runs. The CLI command
@@ -90,7 +94,7 @@ const CONTENT_ROUTES_FILE = './copilot-content-routes.json'
 const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
 
 /** Whether authorization lets a Chat principal through, not only whether the route mints one. */
-function admitsCopilotPrincipal(operation: ApplicationOperation): boolean {
+function admitsCopilotPrincipal(operation: RouteOperation): boolean {
   const kinds: readonly string[] = operation.principalKinds
   const services: readonly string[] | undefined = operation.delegatedServices
   return (
diff --git a/apps/sim/lib/core/application/content-delivery.test.ts b/apps/sim/lib/core/application/content-delivery.test.ts
index 405909b7936..c0db1b09b00 100644
--- a/apps/sim/lib/core/application/content-delivery.test.ts
+++ b/apps/sim/lib/core/application/content-delivery.test.ts
@@ -1,7 +1,8 @@
 /**
  * @vitest-environment node
  */
-import type { Principal } from '@sim/auth/principal'
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { DelegatedServiceId, Principal } from '@sim/auth/principal'
 import { describe, expect, it, vi } from 'vitest'
 import {
   admitContent,
@@ -20,8 +21,9 @@ import {
   trackContentDelivery,
 } from '@/lib/core/application/content-delivery'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+import { PROVENANCE_MAX_ENTRIES } from '@/lib/execution/provenance-limits'
 
-function delegated(serviceId: string): Principal {
+function delegated(serviceId: DelegatedServiceId): Principal {
   const now = Date.now()
   return {
     kind: 'delegated',
@@ -208,43 +210,60 @@ describe('runDeclaredContentOperation', () => {
     expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
   })
 
-  it('answers a write whose gate failed as saved-not-shown, after its effects completed', async () => {
-    const failure = new Error('history unavailable')
-    const failing: ContentDeliveryGate = {
-      async admit() {
-        throw failure
-      },
-    }
-    const events: string[] = []
-    const outcome = await observeContentDelivery(failing, () =>
-      runDeclaredContentOperation(
-        SOURCED,
-        CHAT,
-        async () => {
-          const admission = await admitWrittenContent(CHAT, [source('written')])
-          events.push(`withheld=${admission.refused.length}`)
-          return 'saved row'
+  it.each(['workspace-file', 'tool-result'] as const)(
+    'finishes %s effects before reporting a gate failure with its actual completion state',
+    async (kind) => {
+      const failure = new Error('history unavailable')
+      const failing: ContentDeliveryGate = {
+        async admit() {
+          throw failure
         },
-        async () => {
-          events.push('audit recorded')
-        }
-      ).catch((error: unknown) => error)
-    )
-    expect(events).toEqual(['withheld=1', 'audit recorded'])
-    /** Not the gate's error: that would invite a retry of a write that already committed. */
-    expect(outcome).toBeInstanceOf(ContentRefusedError)
-    expect(outcome).toMatchObject({ message: expect.stringContaining('The change was saved') })
-    /** The request's transport still sees the failure, to answer it itself (the proxy's 502). */
-    const record = await observeContentDelivery(failing, () =>
-      trackContentDelivery(() =>
-        runDeclaredContentOperation(SOURCED, CHAT, async () => {
-          await admitWrittenContent(CHAT, [source('written')])
-          return 'saved row'
-        }).catch(() => 'answered')
+      }
+      const events: string[] = []
+      const outcome = await observeContentDelivery(failing, () =>
+        runDeclaredContentOperation(
+          SOURCED,
+          CHAT,
+          async () => {
+            const admission = await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            events.push(`withheld=${admission.refused.length}`)
+            return 'saved row'
+          },
+          async () => {
+            events.push('audit recorded')
+          }
+        ).catch((error: unknown) => error)
       )
-    )
-    expect(record.gateFailure).toBe(failure)
-  })
+      expect(events).toEqual(['withheld=1', 'audit recorded'])
+      /** Not the gate's error: that would invite a retry of a write that already committed. */
+      expect(outcome).toBeInstanceOf(ContentRefusedError)
+      expect(outcome).toMatchObject({
+        message: expect.stringContaining(
+          kind === 'tool-result' ? 'Tool execution settled' : 'The change was saved'
+        ),
+      })
+      /** The request's transport still sees the failure, to answer it itself (the proxy's 502). */
+      const record = await observeContentDelivery(failing, () =>
+        trackContentDelivery(() =>
+          runDeclaredContentOperation(SOURCED, CHAT, async () => {
+            await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            return 'saved row'
+          }).catch(() => 'answered')
+        )
+      )
+      expect(record.gateFailure).toBe(failure)
+      expect(record.committedWrite).toBe(kind !== 'tool-result')
+      await expect(
+        observeContentDelivery(failing, () =>
+          trackContentDelivery(() =>
+            runDeclaredContentOperation(SOURCED, CHAT, async () => {
+              await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            })
+          )
+        )
+      ).rejects.toMatchObject({ gateFailure: failure, committedWrite: kind !== 'tool-result' })
+    }
+  )
 
   it('does not account for a result whose admission failed and was caught', async () => {
     const failing: ContentDeliveryGate = {
@@ -350,7 +369,91 @@ describe('trackContentDelivery', () => {
       )
     )
     expect(record.unaccounted).toBe(false)
-    expect(record.admitted).toEqual([entries, { status: 'exact', entries: [] }])
+    expect(record.admitted).toEqual([entries])
+  })
+
+  it('keeps one bounded provenance union when nested deferred pages repeat admitted evidence', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const entries = [
+      { encryptedValue: 'first-ciphertext', sourceUserId: 'user-1' },
+      { encryptedValue: 'second-ciphertext', sourceUserId: 'user-1' },
+    ]
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(() =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [])
+          const inRequest = AsyncLocalStorage.snapshot()
+          return () =>
+            inRequest(() =>
+              trackContentDelivery(async () => {
+                await admitContent(
+                  CHAT,
+                  entries.map((entry, index) => ({
+                    ...source(`chunk-${index}`),
+                    provenance: { status: 'exact', entries: [entry] },
+                  }))
+                )
+              })
+            )
+        })
+      )
+    )
+    expect(record.admitted).toEqual([])
+    for (let page = 0; page < 200; page += 1) {
+      const nested = await record.result()
+      expect(nested.admitted).toEqual([{ status: 'exact', entries }])
+    }
+    expect(record.admitted).toEqual([{ status: 'exact', entries }])
+  })
+
+  it('retains unrecorded coverage without retaining every clean or unrecorded source', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(async () => {
+        for (let page = 0; page < 200; page += 1) {
+          await admitContent(CHAT, [
+            source('clean'),
+            { ...source('legacy'), provenance: { status: 'unrecorded' } },
+          ])
+        }
+      })
+    )
+    expect(record.admitted).toEqual([{ status: 'unrecorded' }])
+  })
+
+  it('uses the existing provenance budget for combined delivered evidence', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const entries = Array.from({ length: PROVENANCE_MAX_ENTRIES }, (_, index) => ({
+      encryptedValue: `ciphertext-${index}`,
+      sourceUserId: 'user-1',
+    }))
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(async () => {
+        await admitContent(CHAT, [{ ...source('first'), provenance: { status: 'exact', entries } }])
+        await admitContent(CHAT, [
+          {
+            ...source('overflow'),
+            provenance: {
+              status: 'exact',
+              entries: [{ encryptedValue: 'one-more', sourceUserId: 'user-1' }],
+            },
+          },
+        ])
+      })
+    )
+    expect(record.admitted).toEqual([{ status: 'unknown' }])
   })
 
   it('keeps a nested request’s accounting from satisfying a sibling that never accounted', async () => {
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
index 1de71334c95..ece0901599e 100644
--- a/apps/sim/lib/core/application/content-delivery.ts
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -3,6 +3,7 @@ import type { Principal } from '@sim/auth/principal'
 import type { ApplicationOperation } from '@/lib/core/application/operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { mergeDurableSecretProvenanceSources } from '@/lib/execution/provenance-entries'
 
 /**
  * The secret provenance of one stored item: `exact` names every secret its content can hold,
@@ -17,6 +18,7 @@ export type ContentSourceKind =
   | 'knowledge-document'
   | 'knowledge-chunk'
   | 'table-row'
+  | 'tool-result'
 
 /**
  * How an item's content leaves the use case. `complete` is text in which any of its secrets may
@@ -25,7 +27,7 @@ export type ContentSourceKind =
  */
 export type ContentView = 'complete' | 'opaque' | { derived: unknown }
 
-/** One stored item whose content, or content derived from it, a use case is about to return. */
+/** One stored item or tool result whose content a use case is about to return. */
 export interface ContentSource {
   kind: ContentSourceKind
   /** Canonical id, for attribution and per-item exclusion only. */
@@ -51,7 +53,7 @@ export interface ContentDeliveryGate {
  * Whether a declared operation's result can carry content derived from a provenance-bearing store
  * (workspace files and their versions, execution files, knowledge documents and chunks, table
  * rows): bytes, text, excerpts, cells, previews, base64, archives, public links to such content, or
- * a match oracle over it. `none` is spelled out, as `capability` is, so an operation Chat can reach
+ * returned matches. `none` is spelled out, as `capability` is, so an operation Chat can reach
  * cannot reach production without someone deciding.
  */
 export type ContentDeliveryDeclaration = 'sourced' | 'none'
@@ -65,7 +67,7 @@ interface ContentLedger {
   sourcedOperationAdmitted: boolean
   /** A use case accounted for the sources it returns, even when it returned none. */
   accounted: boolean
-  /** Provenance of every admitted item, for a surface that persists the delivered bytes. */
+  /** Bounded aggregate of admitted provenance, for a surface that persists the delivered bytes. */
   admitted: ContentProvenance[]
   /** A committed write's returned item was refused; the operation answers with a refusal. */
   withheldAfterWrite?: ContentSourceKind
@@ -84,6 +86,8 @@ const MODEL_UNSAFE_CONTENT_MESSAGES: Record<ContentSourceKind, string> = {
     'Document cannot be sent to a model because its secret provenance is unavailable',
   'knowledge-chunk': 'Chunk cannot be sent to a model because its secret provenance is unavailable',
   'table-row': 'Row cannot be sent to a model because its secret provenance is unavailable',
+  'tool-result':
+    'Tool result cannot be sent to a model because its secret provenance is unavailable',
 }
 
 /**
@@ -96,7 +100,9 @@ export class ContentRefusedError extends OrchestrationError {
     super(
       'forbidden',
       options.afterWrite
-        ? `The change was saved. ${MODEL_UNSAFE_CONTENT_MESSAGES[kind]}, so the result is not shown; do not retry the change.`
+        ? kind === 'tool-result'
+          ? 'Tool execution settled, but its result could not be returned safely. Do not retry automatically.'
+          : `The change was saved. ${MODEL_UNSAFE_CONTENT_MESSAGES[kind]}, so the result is not shown; do not retry the change.`
         : MODEL_UNSAFE_CONTENT_MESSAGES[kind]
     )
     this.name = 'ContentRefusedError'
@@ -219,10 +225,33 @@ function markAccounted(): void {
   }
 }
 
+function mergeContentProvenance(
+  values: Iterable<ContentProvenance>
+): ContentProvenance | undefined {
+  let admitted = false
+  let unrecorded = false
+  const merged = mergeDurableSecretProvenanceSources(
+    (function* () {
+      for (const value of values) {
+        admitted = true
+        if (value.status === 'unrecorded') unrecorded = true
+        else yield value
+      }
+    })()
+  )
+  if (!admitted) return undefined
+  if (unrecorded && merged.status === 'exact' && merged.entries.length === 0) {
+    return { status: 'unrecorded' }
+  }
+  return merged
+}
+
 /** A committed write returned an item of `kind` its gate refused or could not decide. */
 function withholdAfterWrite(kind: ContentSourceKind): void {
   for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
-    ledger.withheldAfterWrite ??= kind
+    if (ledger.withheldAfterWrite === undefined || ledger.withheldAfterWrite === 'tool-result') {
+      ledger.withheldAfterWrite = kind
+    }
   }
 }
 
@@ -268,13 +297,20 @@ export async function admitContent(
   }
   markAccounted()
   if (ledger) {
-    sources.forEach((source, index) => {
-      if (verdicts[index]) {
-        for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
-          current.admitted.push(source.provenance)
+    const batch = mergeContentProvenance(
+      (function* () {
+        for (let index = 0; index < sources.length; index++) {
+          if (verdicts[index]) yield sources[index].provenance
         }
+      })()
+    )
+    if (batch) {
+      for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
+        const previous = current.admitted[0]
+        const aggregate = previous ? mergeContentProvenance([previous, batch]) : batch
+        if (aggregate) current.admitted.splice(0, current.admitted.length, aggregate)
       }
-    })
+    }
   }
   return new ContentAdmission(sources, verdicts)
 }
@@ -378,7 +414,7 @@ export interface ContentDeliveryRecord<T> {
   gateFailure?: unknown
   /** A write committed, then its returned content was withheld: the change happened. */
   committedWrite: boolean
-  /** Provenance of every admitted item, in admission order. */
+  /** Bounded aggregate of admitted provenance, updated in place during deferred delivery. */
   admitted: readonly ContentProvenance[]
 }
 
@@ -402,12 +438,16 @@ export async function trackContentDelivery<T>(
   } catch (error) {
     /** The request threw because its gate failed; its transport answers that, not the error. */
     if (ledger.gateFailure === undefined) throw error
-    throw new ContentGateFailure(ledger.gateFailure, ledger.withheldAfterWrite !== undefined)
+    throw new ContentGateFailure(
+      ledger.gateFailure,
+      ledger.withheldAfterWrite !== undefined && ledger.withheldAfterWrite !== 'tool-result'
+    )
   }
   return {
     result,
     unaccounted: ledger.sourcedOperationAdmitted && !ledger.accounted,
-    committedWrite: ledger.withheldAfterWrite !== undefined,
+    committedWrite:
+      ledger.withheldAfterWrite !== undefined && ledger.withheldAfterWrite !== 'tool-result',
     admitted: ledger.admitted,
     ...(ledger.gateFailure === undefined ? {} : { gateFailure: ledger.gateFailure }),
   }
diff --git a/apps/sim/lib/core/application/workspace-operation.ts b/apps/sim/lib/core/application/workspace-operation.ts
index be368d787d7..037c5d90025 100644
--- a/apps/sim/lib/core/application/workspace-operation.ts
+++ b/apps/sim/lib/core/application/workspace-operation.ts
@@ -75,10 +75,14 @@ type DelegatedPrincipalConsistency<
  * Chat delivers whatever a Copilot-admitted operation returns to its model, so each one says
  * whether that can be stored content; no other operation may claim to.
  */
-type ContentDeliveryConsistency<DelegatedServices extends readonly DelegatedServiceId[]> =
-  'copilot' extends DelegatedServices[number]
+type ContentDeliveryConsistency<
+  PrincipalKinds extends readonly PrincipalKind[],
+  DelegatedServices extends readonly DelegatedServiceId[],
+> = 'delegated' extends PrincipalKinds[number]
+  ? 'copilot' extends DelegatedServices[number]
     ? { readonly contentDelivery: ContentDeliveryDeclaration }
     : { readonly contentDelivery?: never }
+  : { readonly contentDelivery?: never }
 
 type ResourcePolicyOperationConsistency<Binding extends ResourcePolicyBinding | undefined> =
   Binding extends ResourcePolicyBinding
@@ -96,7 +100,7 @@ export function defineWorkspaceOperation<
     OAuthOperationPolicy<PrincipalKinds> &
     WorkspaceApiKeyPrincipalConsistency<Role, PrincipalKinds> &
     DelegatedPrincipalConsistency<PrincipalKinds, DelegatedServices> &
-    ContentDeliveryConsistency<DelegatedServices> &
+    ContentDeliveryConsistency<PrincipalKinds, DelegatedServices> &
     ResourcePolicyOperationConsistency<ResourcePolicy>
 ): WorkspaceOperation<Id, Role, PrincipalKinds, DelegatedServices> &
   OAuthOperationPolicy<PrincipalKinds> &
diff --git a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
index 2894efbf826..49c4c19d9f3 100644
--- a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
@@ -9,7 +9,12 @@ import { createLogger } from '@sim/logger'
 
 const persistenceLogger = createLogger('DurableSecretProvenancePersistence')
 
-export type DurableSecretProvenanceSurface = 'memory' | 'table-row' | 'knowledge' | 'workspace-file'
+export type DurableSecretProvenanceSurface =
+  | 'memory'
+  | 'table-row'
+  | 'knowledge'
+  | 'workspace-file'
+  | 'tool-result'
 
 export type DurableSecretProvenanceWriteCause =
   | 'source-provenance-unknown'
@@ -39,6 +44,7 @@ export type DurableSecretProvenanceRefusalCause =
   | 'table-row-opaque-secret-content'
   | 'knowledge-opaque-secret-content'
   | 'content-registry-unavailable'
+  | 'tool-result-provenance-unavailable'
 
 export interface DurableSecretProvenanceRefusalReport {
   surface: DurableSecretProvenanceSurface
diff --git a/apps/sim/lib/execution/durable-secret-provenance.ts b/apps/sim/lib/execution/durable-secret-provenance.ts
index 980c666298f..8aa351aaaa5 100644
--- a/apps/sim/lib/execution/durable-secret-provenance.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance.ts
@@ -5,8 +5,10 @@ import {
   isPrivateSecretProvenanceBundleV1,
   type PrivateSecretProvenanceBundleV1,
 } from '@/lib/execution/model-input-provenance'
-import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
-import { PROVENANCE_MAX_SERIALIZED_BYTES } from '@/lib/execution/provenance-limits'
+import {
+  mergeDurableSecretProvenanceSources,
+  normalizeDurableSecretProvenanceBindings,
+} from '@/lib/execution/provenance-entries'
 import {
   type ResolvedSecretTraceProvenanceV1,
   ResolvedSecretTraceRegistry,
@@ -32,59 +34,6 @@ export function normalizeDurableSecretProvenanceEntries(
   return Array.isArray(value) ? normalizeDurableSecretProvenanceBindings(value) : undefined
 }
 
-function normalizeDurableSecretProvenanceBindings(
-  candidates: Iterable<unknown>
-): DurableSecretProvenanceEntry[] | undefined {
-  const entries = new Map<string, DurableSecretProvenanceEntry>()
-  const budget = new SecretProvenanceBudget()
-  for (const candidate of candidates) {
-    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) return undefined
-    const record = candidate as Record<string, unknown>
-    if (
-      typeof record.encryptedValue !== 'string' ||
-      record.encryptedValue.length === 0 ||
-      (record.name !== undefined && typeof record.name !== 'string') ||
-      (record.sourceUserId !== undefined && typeof record.sourceUserId !== 'string') ||
-      (record.sourceWorkspaceId !== undefined && typeof record.sourceWorkspaceId !== 'string') ||
-      (record.sourceValueHash !== undefined && typeof record.sourceValueHash !== 'string') ||
-      (record.sourceWorkspaceId !== undefined && record.sourceUserId === undefined)
-    ) {
-      return undefined
-    }
-    const entry: DurableSecretProvenanceEntry = {
-      encryptedValue: record.encryptedValue,
-      ...(typeof record.name === 'string' && record.name.length > 0 ? { name: record.name } : {}),
-      ...(typeof record.sourceUserId === 'string' && record.sourceUserId.length > 0
-        ? { sourceUserId: record.sourceUserId }
-        : {}),
-      ...(typeof record.sourceWorkspaceId === 'string' && record.sourceWorkspaceId.length > 0
-        ? { sourceWorkspaceId: record.sourceWorkspaceId }
-        : {}),
-      ...(typeof record.sourceValueHash === 'string' && record.sourceValueHash.length > 0
-        ? { sourceValueHash: record.sourceValueHash }
-        : {}),
-    }
-    let minimumBytes = 0
-    for (const field of Object.values(entry)) {
-      minimumBytes += Buffer.byteLength(field, 'utf8')
-      if (minimumBytes > PROVENANCE_MAX_SERIALIZED_BYTES) return undefined
-    }
-    const key = JSON.stringify(entry)
-    if (entries.has(key)) continue
-    if (!budget.add(entry.encryptedValue, Buffer.byteLength(key, 'utf8'))) return undefined
-    entries.set(key, entry)
-  }
-
-  return [...entries.values()].sort(
-    (left, right) =>
-      compareStrings(left.sourceUserId ?? '', right.sourceUserId ?? '') ||
-      compareStrings(left.sourceWorkspaceId ?? '', right.sourceWorkspaceId ?? '') ||
-      compareStrings(left.sourceValueHash ?? '', right.sourceValueHash ?? '') ||
-      compareStrings(left.name ?? '', right.name ?? '') ||
-      compareStrings(left.encryptedValue, right.encryptedValue)
-  )
-}
-
 /** Converts a complete transport envelope into its scope-preserving durable representation. */
 export function durableSecretProvenanceFromEnvelope(
   provenance: ResolvedSecretTraceProvenanceV1
@@ -155,15 +104,7 @@ export function durableSecretProvenanceFromPrivateBundle(
 export function mergeDurableSecretProvenance(
   ...values: readonly DurableSecretProvenance[]
 ): DurableSecretProvenance {
-  if (values.some((value) => value.status === 'unknown')) return { status: 'unknown' }
-  const normalized = normalizeDurableSecretProvenanceBindings(
-    (function* () {
-      for (const value of values) {
-        if (value.status === 'exact') yield* value.entries
-      }
-    })()
-  )
-  return normalized ? { status: 'exact', entries: normalized } : { status: 'unknown' }
+  return mergeDurableSecretProvenanceSources(values)
 }
 
 /** Binds exact entries to one persisted sub-value so later slicing cannot activate dropped data. */
@@ -201,10 +142,11 @@ export function filterDurableSecretProvenanceBySourceValues(
 export async function importDurableSecretProvenance(
   registry: ResolvedSecretTraceRegistry,
   provenance: DurableSecretProvenance,
-  value?: unknown
+  value?: unknown,
+  options: { atomic?: boolean } = {}
 ): Promise<boolean> {
   if (provenance.status === 'unknown') {
-    registry.markIncomplete('durable-provenance-unknown')
+    if (!options.atomic) registry.markIncomplete('durable-provenance-unknown')
     return false
   }
   const entries = normalizeDurableSecretProvenanceEntries(provenance.entries)
@@ -213,7 +155,7 @@ export async function importDurableSecretProvenance(
      * Malformed is not unrecorded: a sidecar that exists but cannot be parsed is a fault, and no
      * enforcement policy relaxes it.
      */
-    registry.markIncomplete('durable-provenance-malformed')
+    if (!options.atomic) registry.markIncomplete('durable-provenance-malformed')
     return false
   }
 
@@ -244,14 +186,25 @@ export async function importDurableSecretProvenance(
     group.entries.set(JSON.stringify(transportEntry), transportEntry)
   }
 
-  let complete = true
-  for (const group of grouped.values()) {
-    const envelope: ResolvedSecretTraceProvenanceV1 = {
-      version: 1,
-      complete: true,
-      entries: [...group.entries.values()],
-      ...(group.scope ? { scope: group.scope } : {}),
+  function* envelopes(): Generator<ResolvedSecretTraceProvenanceV1> {
+    for (const group of grouped.values()) {
+      yield {
+        version: 1,
+        complete: true,
+        entries: [...group.entries.values()],
+        ...(group.scope ? { scope: group.scope } : {}),
+      }
     }
+  }
+  if (options.atomic) {
+    return registry.tryImportProvenance(envelopes(), {
+      trusted: true,
+      origin: 'durableProvenance.admission',
+      value,
+    })
+  }
+  let complete = true
+  for (const envelope of envelopes()) {
     const imported =
       value === undefined
         ? await registry.importProvenance(envelope, {
diff --git a/apps/sim/lib/execution/provenance-entries.ts b/apps/sim/lib/execution/provenance-entries.ts
new file mode 100644
index 00000000000..b7ed0bdef1c
--- /dev/null
+++ b/apps/sim/lib/execution/provenance-entries.ts
@@ -0,0 +1,78 @@
+import type { DurableSecretProvenanceEntry } from '@sim/db/schema'
+import { compareStrings } from '@sim/utils/string'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
+import { PROVENANCE_MAX_SERIALIZED_BYTES } from '@/lib/execution/provenance-limits'
+
+/** Normalizes and folds streamed durable bindings within the existing provenance budget. */
+export function normalizeDurableSecretProvenanceBindings(
+  candidates: Iterable<unknown>
+): DurableSecretProvenanceEntry[] | undefined {
+  const entries = new Map<string, DurableSecretProvenanceEntry>()
+  const budget = new SecretProvenanceBudget()
+  for (const candidate of candidates) {
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) return undefined
+    const record = candidate as Record<string, unknown>
+    if (
+      typeof record.encryptedValue !== 'string' ||
+      record.encryptedValue.length === 0 ||
+      (record.name !== undefined && typeof record.name !== 'string') ||
+      (record.sourceUserId !== undefined && typeof record.sourceUserId !== 'string') ||
+      (record.sourceWorkspaceId !== undefined && typeof record.sourceWorkspaceId !== 'string') ||
+      (record.sourceValueHash !== undefined && typeof record.sourceValueHash !== 'string') ||
+      (record.sourceWorkspaceId !== undefined && record.sourceUserId === undefined)
+    ) {
+      return undefined
+    }
+    const entry: DurableSecretProvenanceEntry = {
+      encryptedValue: record.encryptedValue,
+      ...(typeof record.name === 'string' && record.name.length > 0 ? { name: record.name } : {}),
+      ...(typeof record.sourceUserId === 'string' && record.sourceUserId.length > 0
+        ? { sourceUserId: record.sourceUserId }
+        : {}),
+      ...(typeof record.sourceWorkspaceId === 'string' && record.sourceWorkspaceId.length > 0
+        ? { sourceWorkspaceId: record.sourceWorkspaceId }
+        : {}),
+      ...(typeof record.sourceValueHash === 'string' && record.sourceValueHash.length > 0
+        ? { sourceValueHash: record.sourceValueHash }
+        : {}),
+    }
+    let minimumBytes = 0
+    for (const field of Object.values(entry)) {
+      minimumBytes += Buffer.byteLength(field, 'utf8')
+      if (minimumBytes > PROVENANCE_MAX_SERIALIZED_BYTES) return undefined
+    }
+    const key = JSON.stringify(entry)
+    if (entries.has(key)) continue
+    if (!budget.add(entry.encryptedValue, Buffer.byteLength(key, 'utf8'))) return undefined
+    entries.set(key, entry)
+  }
+
+  return [...entries.values()].sort(
+    (left, right) =>
+      compareStrings(left.sourceUserId ?? '', right.sourceUserId ?? '') ||
+      compareStrings(left.sourceWorkspaceId ?? '', right.sourceWorkspaceId ?? '') ||
+      compareStrings(left.sourceValueHash ?? '', right.sourceValueHash ?? '') ||
+      compareStrings(left.name ?? '', right.name ?? '') ||
+      compareStrings(left.encryptedValue, right.encryptedValue)
+  )
+}
+
+/** Merges streamed source evidence within the shared budget without materializing the sources. */
+export function mergeDurableSecretProvenanceSources(
+  values: Iterable<DurableSecretProvenance>
+): DurableSecretProvenance {
+  let unknown = false
+  const normalized = normalizeDurableSecretProvenanceBindings(
+    (function* () {
+      for (const value of values) {
+        if (value.status === 'unknown') {
+          unknown = true
+          return
+        }
+        yield* value.entries
+      }
+    })()
+  )
+  return !unknown && normalized ? { status: 'exact', entries: normalized } : { status: 'unknown' }
+}
diff --git a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
new file mode 100644
index 00000000000..813685f3233
--- /dev/null
+++ b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
@@ -0,0 +1,231 @@
+import { execFile } from 'node:child_process'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { db } from '@sim/db'
+import { auditLog, organization, user, workspace } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { toolsMock, toolsMockFns } from '@sim/testing/mocks/tools.mock'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/tools', () => toolsMock)
+
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
+import { executeFunctionExecute } from '@/lib/mothership/tools/handlers/function-execute'
+import { compileDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import {
+  updateWorkspaceFileContent,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { getBoundWorkspaceFileSecretProvenanceByIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const execute = promisify(execFile)
+const secret = 'synthetic-broker-value-987654321'
+
+describe('Chat admits the file revision used by a sandbox', () => {
+  const ids = createKnowledgeAclFixtureIds()
+  const chatId = generateId()
+  let fileId: string
+  let workbench: string
+
+  beforeAll(async () => {
+    storage.root = await mkdtemp(join(tmpdir(), 'sim-broker-content-'))
+    workbench = await mkdtemp(join(tmpdir(), 'sim-input-content-'))
+    await seedKnowledgeAclFixture(ids)
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from('public bytes'),
+      'source.txt',
+      'text/plain',
+      { notifyWorkspaceChange: false }
+    )
+    fileId = file.id
+  })
+  afterAll(async () => {
+    await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+    await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+    await db.delete(organization).where(eq(organization.id, ids.organizationId))
+    await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+    await rm(storage.root, { recursive: true, force: true })
+    await rm(workbench, { recursive: true, force: true })
+  })
+
+  function compile(source: string, registry: ResolvedSecretTraceRegistry) {
+    return observeContentDelivery(
+      createRegistryContentGate({
+        registry,
+        workspaceId: ids.workspaceId,
+        actorUserId: ids.aliceId,
+      }),
+      () =>
+        compileDoc({
+          source,
+          fileName: 'fixture.pdf',
+          workspaceId: ids.workspaceId,
+          filePrincipal: createCopilotChatFilePrincipal({
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+            chatId,
+          }),
+        })
+    )
+  }
+  function registry() {
+    return new ResolvedSecretTraceRegistry([], {
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+    })
+  }
+
+  it('reads variable file references through the real isolated worker and invalidates cached source revisions', async () => {
+    const source = `const id = ${JSON.stringify(fileId)}; const data = await getFileBase64(id); pdf.addPage().drawText(data);`
+    const first = await compile(source, registry())
+    expect(first.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(first.contributingFiles).toHaveLength(1)
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('updated public bytes'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'exact', entries: [] } },
+      }
+    )
+    const second = await compile(source, registry())
+    expect(second.contributingFiles?.[0].key).not.toBe(first.contributingFiles?.[0].key)
+    const revisions = [...(first.contributingFiles ?? []), ...(second.contributingFiles ?? [])]
+    for (const identities of [revisions, [...revisions].reverse()]) {
+      const bound = await getBoundWorkspaceFileSecretProvenanceByIdentity(
+        ids.workspaceId,
+        identities
+      )
+      expect(bound.get(fileId)).toEqual({ status: 'unknown' })
+    }
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified bytes'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    await expect(compile(source, registry())).rejects.toThrow(/provenance|read safely/i)
+  }, 60_000)
+
+  it('imports evidence before a broker response can appear in a compiler error', async () => {
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from(secret),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: {
+          mode: 'replace',
+          provenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'BROKER_TOKEN',
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+              },
+            ],
+          },
+        },
+      }
+    )
+    const trace = registry()
+    let message = ''
+    try {
+      await compile(
+        `const id = ${JSON.stringify(fileId)}; const uri = await getFileBase64(id); throw new Error(Buffer.from(uri.split(',')[1], 'base64').toString());`,
+        trace
+      )
+    } catch (error) {
+      if (!(error instanceof Error)) throw error
+      message = error.message
+    }
+    expect(message).toContain(secret)
+    const projected = projectResolvedSecretModelContent(message, trace)
+    if (!projected.safe) throw new Error('Expected a safely projected compiler error')
+    expect(projected.value).not.toContain(secret)
+    expect(projected.value).toContain('{{BROKER_TOKEN}}')
+  }, 60_000)
+
+  it('does not run code with a stale local file after refusing its requested replacement', async () => {
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified replacement'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    await writeFile(join(workbench, 'source.txt'), 'previous mounted version')
+    await writeFile(join(workbench, 'result.txt'), 'not executed')
+    toolsMockFns.mockExecuteTool.mockImplementation(async (_id, params: { code: string }) => {
+      const output = await execute(process.execPath, ['-e', params.code], { cwd: workbench })
+      return { success: true, output }
+    })
+    const context = {
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      chatId,
+      toolCallId: generateId(),
+      workflowId: '',
+      copilotToolExecution: true,
+      resolvedSecretTraceRegistry: registry(),
+    }
+    const code =
+      "const fs = require('node:fs'); fs.writeFileSync('result.txt', fs.readFileSync('source.txt'));"
+    const result = await executeFunctionExecute(
+      {
+        code,
+        language: 'javascript',
+        inputs: { files: [{ path: fileId, sandboxPath: '/tmp/source.txt' }] },
+      },
+      context
+    )
+    expect(await readFile(join(workbench, 'result.txt'), 'utf8')).toBe('not executed')
+    expect(result).toMatchObject({
+      success: false,
+      output: { codeExecuted: false, excludedInputs: [{ path: '/tmp/source.txt' }] },
+    })
+    expect(context.resolvedSecretTraceRegistry.isComplete()).toBe(true)
+    const next = await executeFunctionExecute(
+      { code: "process.stdout.write('clock usable')", language: 'javascript' },
+      context
+    )
+    expect(next).toMatchObject({ success: true, output: { stdout: 'clock usable' } })
+  })
+})
diff --git a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
index 31bfcad0b5b..6be2e8196df 100644
--- a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
+++ b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
@@ -8,6 +8,7 @@ import {
   fetchWorkspaceFileBuffer,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 
 const logger = createLogger('SandboxWorkspaceFileBroker')
 
@@ -34,13 +35,24 @@ export const workspaceFileBroker: SandboxBroker<WorkspaceFileArgs, WorkspaceFile
     if (!ctx.workspaceId) {
       throw new Error('workspaceFile broker requires a workspaceId')
     }
-    if (ctx.readableWorkspaceFileIds && !ctx.readableWorkspaceFileIds.has(args.fileId)) {
-      throw new Error(
-        `File ${args.fileId} is not readable here; reference input files by their literal id, e.g. getFileBase64("<file id>")`
-      )
-    }
+    const admitted = ctx.filePrincipal
+      ? await readWorkspaceFileContent.execute({
+          principal: ctx.filePrincipal,
+          input: {
+            fileId: args.fileId,
+            assertedWorkspaceId: ctx.workspaceId,
+            maxBytes:
+              Math.floor(
+                Math.min(
+                  MAX_SANDBOX_IMAGE_DATA_URI_CHARS,
+                  MAX_ISOLATED_VM_BROKER_RESULT_JSON_CHARS
+                ) / 4
+              ) * 3,
+          },
+        })
+      : undefined
 
-    const record = await getWorkspaceFile(ctx.workspaceId, args.fileId)
+    const record = admitted?.file ?? (await getWorkspaceFile(ctx.workspaceId, args.fileId))
     if (!record) {
       logger.warn('Workspace file not found for sandbox broker', {
         workspaceId: ctx.workspaceId,
@@ -60,7 +72,9 @@ export const workspaceFileBroker: SandboxBroker<WorkspaceFileArgs, WorkspaceFile
       )
     )
     const maxBytes = Math.floor(availableBase64Chars / 4) * 3
-    const buffer = await fetchWorkspaceFileBuffer(record, { maxBytes })
+    const buffer = admitted?.content ?? (await fetchWorkspaceFileBuffer(record, { maxBytes }))
+    if (buffer.length > maxBytes)
+      throw new Error('Workspace file exceeds the sandbox image byte limit')
     ctx.onWorkspaceFileAccess?.({
       fileId: record.id,
       key: record.key,
diff --git a/apps/sim/lib/execution/sandbox/run-task.ts b/apps/sim/lib/execution/sandbox/run-task.ts
index fffca065871..38f3edad77d 100644
--- a/apps/sim/lib/execution/sandbox/run-task.ts
+++ b/apps/sim/lib/execution/sandbox/run-task.ts
@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
 import {
@@ -20,7 +21,7 @@ export interface RunSandboxTaskOptions {
   signal?: AbortSignal
   /** Records canonical workspace files whose bytes were successfully read by a task broker. */
   onWorkspaceFileAccess?: SandboxBrokerContext['onWorkspaceFileAccess']
-  readableWorkspaceFileIds?: SandboxBrokerContext['readableWorkspaceFileIds']
+  filePrincipal?: SandboxBrokerContext['filePrincipal']
   /** Run id that brokers see as `ctx.requestId`, for callers that keep per-run broker state. */
   requestId?: string
 }
@@ -60,13 +61,12 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
     workspaceId: input.workspaceId,
     requestId,
     onWorkspaceFileAccess: options.onWorkspaceFileAccess,
-    ...(options.readableWorkspaceFileIds
-      ? { readableWorkspaceFileIds: options.readableWorkspaceFileIds }
-      : {}),
+    filePrincipal: options.filePrincipal,
   }
   const brokers: Record<string, IsolatedVMBrokerHandler> = {}
+  const runInCallerContext = AsyncLocalStorage.snapshot()
   for (const broker of task.brokers) {
-    brokers[broker.name] = (args) => broker.handle(brokerContext, args)
+    brokers[broker.name] = (args) => runInCallerContext(() => broker.handle(brokerContext, args))
   }
 
   const request: IsolatedVMExecutionRequest = {
diff --git a/apps/sim/lib/execution/sandbox/types.ts b/apps/sim/lib/execution/sandbox/types.ts
index eb2b93ef0c1..eaa3066da29 100644
--- a/apps/sim/lib/execution/sandbox/types.ts
+++ b/apps/sim/lib/execution/sandbox/types.ts
@@ -1,3 +1,5 @@
+import type { Principal } from '@sim/auth/principal'
+
 /**
  * Types for the sandbox task system.
  *
@@ -24,11 +26,8 @@ export interface SandboxBroker<TArgs = unknown, TResult = unknown> {
 export interface SandboxBrokerContext {
   workspaceId: string
   requestId: string
-  /**
-   * The only workspace files the broker may read, when set: each was admitted for the caller
-   * before the task ran, since the isolate's calls cannot be classified as they arrive.
-   */
-  readableWorkspaceFileIds?: ReadonlySet<string>
+  /** Host-side identity used to authorize and admit each actual broker read. Never sent to the isolate. */
+  filePrincipal?: Principal
   onWorkspaceFileAccess?: (identity: {
     fileId: string
     key: string
diff --git a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
new file mode 100644
index 00000000000..7c8ebc6d217
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
@@ -0,0 +1,465 @@
+/** Real PostgreSQL content admission, pagination, captured metadata, and streamed ZIP readback. */
+import * as audit from '@sim/audit'
+import { db } from '@sim/db'
+import {
+  auditLog,
+  document,
+  embedding,
+  knowledgeBase,
+  organization,
+  user,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { sha256Hex } from '@sim/security/hash'
+import { generateId } from '@sim/utils/id'
+import { isRecordLike } from '@sim/utils/object'
+import { eq, inArray } from 'drizzle-orm'
+import { PostgresJsPreparedQuery } from 'drizzle-orm/postgres-js/session'
+import JSZip from 'jszip'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
+import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import { listKnowledgeDocuments } from '@/lib/knowledge/application/documents'
+import {
+  exportKnowledgeBase,
+  type KnowledgeBaseExportBundle,
+} from '@/lib/knowledge/application/exports'
+import {
+  readDetailedKnowledgeTagUsage,
+  readKnowledgeTagUsage,
+} from '@/lib/knowledge/application/tags'
+import {
+  bindKnowledgeDocumentFieldSecretProvenance,
+  classifyKnowledgeDocumentMetadata,
+  createKnowledgeDocumentSourceValue,
+  replaceKnowledgeDocumentSecretProvenanceInTx,
+  replaceKnowledgeEmbeddingSecretProvenanceInTx,
+} from '@/lib/knowledge/secret-provenance'
+import { buildKnowledgeBundleArchive } from '@/lib/knowledge/transfer/export-archive'
+import { embeddingVectorValues } from '@/lib/knowledge/vector-columns'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const SECRET = 'fixture-knowledge-token-41875'
+const ids = createKnowledgeAclFixtureIds()
+const principal = createCopilotChatPrincipal(
+  { userId: ids.aliceId, workspaceId: ids.workspaceId },
+  KNOWLEDGE_DELEGATION_AUDIENCE
+)
+const session = { kind: 'session' as const, userId: ids.aliceId, sessionId: generateId() }
+let exact: DurableSecretProvenance
+let submittedAudits = 0
+
+function inChat<T>(read: () => T) {
+  return observeContentDelivery(
+    createRegistryContentGate({
+      registry: new ResolvedSecretTraceRegistry([], {
+        userId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      }),
+      actorUserId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+    }),
+    read
+  )
+}
+
+async function seedDocument(
+  options: {
+    name?: string
+    content?: string
+    provenance?: DurableSecretProvenance
+    original?: boolean
+  } = {}
+) {
+  const content = options.content ?? 'page public content'
+  const id = generateId()
+  const [row] = await db
+    .insert(document)
+    .values({
+      id,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      filename: options.name ?? 'page.txt',
+      fileUrl:
+        options.original === false
+          ? ''
+          : `data:text/plain;base64,${Buffer.from(content).toString('base64')}`,
+      fileSize: Buffer.byteLength(content),
+      mimeType: 'text/plain',
+      processingStatus: 'completed',
+      chunkCount: 1,
+      tag1: 'public',
+      acl: ['ws'],
+      aclRequirements: [],
+      aclVerifiedAt: new Date(),
+    })
+    .returning()
+  const provenance = options.provenance
+  if (provenance)
+    await db.transaction((tx) =>
+      replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        id,
+        createKnowledgeDocumentSourceValue(row),
+        provenance
+      )
+    )
+  const chunkId = await seedChunk(id, 0, content)
+  return { id, chunkId, content }
+}
+
+async function seedChunk(
+  documentId: string,
+  index: number,
+  content: string,
+  provenance?: DurableSecretProvenance
+) {
+  const id = generateId()
+  await db.insert(embedding).values({
+    id,
+    documentId,
+    knowledgeBaseId: ids.knowledgeBaseId,
+    chunkIndex: index,
+    ...embeddingVectorValues(1536, [1, ...Array<number>(1535).fill(0)]),
+    chunkHash: sha256Hex(content),
+    content,
+    contentLength: content.length,
+    tokenCount: 4,
+    startOffset: 0,
+    endOffset: content.length,
+    tag1: 'public',
+  })
+  if (provenance)
+    await db.transaction((tx) =>
+      replaceKnowledgeEmbeddingSecretProvenanceInTx(tx, id, content, provenance)
+    )
+  return id
+}
+
+async function exportedBundle(human = false) {
+  return inChat(() =>
+    exportKnowledgeBase.execute({
+      principal: human ? session : principal,
+      input: { knowledgeBaseId: ids.knowledgeBaseId, vectors: false },
+    })
+  )
+}
+
+async function archiveBytes(bundle: KnowledgeBaseExportBundle) {
+  const buffers: Buffer[] = []
+  for await (const chunk of buildKnowledgeBundleArchive(bundle)) buffers.push(Buffer.from(chunk))
+  return Buffer.concat(buffers)
+}
+
+async function drainAudits() {
+  await vi.waitFor(async () =>
+    expect(
+      await db
+        .select({ id: auditLog.id })
+        .from(auditLog)
+        .where(eq(auditLog.workspaceId, ids.workspaceId))
+    ).toHaveLength(submittedAudits)
+  )
+}
+
+beforeAll(async () => {
+  await seedKnowledgeAclFixture(ids)
+  const record = audit.recordAudit
+  vi.spyOn(audit, 'recordAudit').mockImplementation((entry) => {
+    if (entry.workspaceId === ids.workspaceId) submittedAudits += 1
+    record(entry)
+  })
+  const recordBatch = audit.recordAuditBatch
+  vi.spyOn(audit, 'recordAuditBatch').mockImplementation((entries) => {
+    submittedAudits += entries.filter((entry) => entry.workspaceId === ids.workspaceId).length
+    recordBatch(entries)
+  })
+  exact = {
+    status: 'exact',
+    entries: [
+      {
+        encryptedValue: (await encryptSecret(SECRET)).encrypted,
+        sourceUserId: ids.aliceId,
+        sourceWorkspaceId: ids.workspaceId,
+        name: 'FIXTURE_TOKEN',
+      },
+    ],
+  }
+})
+afterEach(async () => {
+  await drainAudits()
+  await db.delete(document).where(eq(document.knowledgeBaseId, ids.knowledgeBaseId))
+})
+afterAll(async () => {
+  await drainAudits()
+  vi.restoreAllMocks()
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await db.delete(knowledgeBase).where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  await db.$client.end()
+})
+
+describe('knowledge content delivery', () => {
+  it('classifies a mixed metadata page without materializing multiple inline originals together', async () => {
+    const content = 'inline source content '.repeat(8192)
+    const legacy = await seedDocument({ content })
+    const clean = await seedDocument({ content, provenance: { status: 'exact', entries: [] } })
+    const unknown = await seedDocument({ content, provenance: { status: 'unknown' } })
+    const tracked = await seedDocument({ content })
+    const [trackedRow] = await db
+      .update(document)
+      .set({ tag1: SECRET })
+      .where(eq(document.id, tracked.id))
+      .returning()
+    await db.transaction((tx) =>
+      replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        tracked.id,
+        createKnowledgeDocumentSourceValue(trackedRow),
+        bindKnowledgeDocumentFieldSecretProvenance(exact, 'tag1', SECRET)
+      )
+    )
+    const originalBytes = Buffer.byteLength(
+      `data:text/plain;base64,${Buffer.from(content).toString('base64')}`
+    )
+    let peakOriginalBytes = 0
+    const execute = PostgresJsPreparedQuery.prototype.execute
+    const measure = vi
+      .spyOn(PostgresJsPreparedQuery.prototype, 'execute')
+      .mockImplementation(async function (this: typeof PostgresJsPreparedQuery.prototype, values) {
+        const rows = await execute.call(this, values)
+        if (Array.isArray(rows)) {
+          let bytes = 0
+          for (const row of rows) {
+            if (!isRecordLike(row)) continue
+            const value = row.fileUrl
+            if (typeof value === 'string' && value.startsWith('data:'))
+              bytes += Buffer.byteLength(value)
+          }
+          peakOriginalBytes = Math.max(peakOriginalBytes, bytes)
+        }
+        return rows
+      })
+    try {
+      const result = await classifyKnowledgeDocumentMetadata([
+        legacy.id,
+        clean.id,
+        unknown.id,
+        tracked.id,
+      ])
+      expect(result.get(legacy.id)).toEqual({ status: 'exact', entries: [] })
+      expect(result.get(clean.id)).toEqual({ status: 'exact', entries: [] })
+      expect(result.get(unknown.id)).toEqual({ status: 'unknown' })
+      expect(result.get(tracked.id)).toMatchObject({
+        status: 'exact',
+        entries: [{ name: 'FIXTURE_TOKEN' }],
+      })
+      expect(peakOriginalBytes).toBeGreaterThan(0)
+      expect(peakOriginalBytes).toBeLessThanOrEqual(originalBytes)
+    } finally {
+      measure.mockRestore()
+    }
+  })
+
+  it('keeps stored search totals and continuation while withholding only unsafe documents', async () => {
+    await seedDocument({ name: 'page-a.txt' })
+    await seedDocument({ name: 'page-b.txt', provenance: { status: 'unknown' } })
+    await seedDocument({ name: 'page-c.txt' })
+    const result = await inChat(() =>
+      listKnowledgeDocuments.execute({
+        principal,
+        input: {
+          knowledgeBaseId: ids.knowledgeBaseId,
+          search: 'page',
+          limit: 2,
+          sortBy: 'filename',
+          sortOrder: 'asc',
+        },
+      })
+    )
+    expect(result.documents.map((row) => row.filename)).toEqual(['page-a.txt'])
+    expect(result.pagination).toMatchObject({ total: 3, hasMore: true })
+  })
+
+  it('keeps chunk search totals and its next page when one matching chunk is withheld', async () => {
+    const doc = await seedDocument()
+    await seedChunk(doc.id, 1, 'page withheld content', { status: 'unknown' })
+    await seedChunk(doc.id, 2, 'page final content')
+    const result = await inChat(() =>
+      listKnowledgeChunks.execute({
+        principal,
+        input: {
+          knowledgeBaseId: ids.knowledgeBaseId,
+          documentId: doc.id,
+          search: 'page',
+          limit: 2,
+        },
+      })
+    )
+    expect(result.chunks.map((row) => row.content)).toEqual(['page public content'])
+    expect(result.pagination).toMatchObject({ total: 3, hasMore: true })
+    expect(result.nextCursorKeys).not.toBeNull()
+  })
+
+  it('returns ordinary aggregate counts while admitting detailed tag metadata per document', async () => {
+    const clean = await seedDocument()
+    await seedDocument({ provenance: { status: 'unknown' } })
+    const stats = await inChat(() =>
+      readKnowledgeTagUsage.execute({ principal, input: { knowledgeBaseId: ids.knowledgeBaseId } })
+    )
+    expect(stats.usage.find((row) => row.tagSlot === 'tag1')).toMatchObject({
+      documentCount: 2,
+      chunkCount: 2,
+    })
+    const detail = await inChat(() =>
+      readDetailedKnowledgeTagUsage.execute({
+        principal,
+        input: { knowledgeBaseId: ids.knowledgeBaseId },
+      })
+    )
+    expect(detail.usage[0].documents.map((row) => row.id)).toEqual([clean.id])
+  })
+
+  it.each(['tag1', 'filename'] as const)(
+    'binds captured chunk %s metadata to the row classified at delivery',
+    async (field) => {
+      const doc = await seedDocument()
+      const captured = {
+        id: doc.chunkId,
+        documentId: doc.id,
+        content: doc.content,
+        value: { content: doc.content, [field]: SECRET },
+      }
+      await db
+        .update(document)
+        .set({ [field]: SECRET })
+        .where(eq(document.id, doc.id))
+      const [secretRow] = await db.select().from(document).where(eq(document.id, doc.id))
+      await db.transaction((tx) =>
+        replaceKnowledgeDocumentSecretProvenanceInTx(
+          tx,
+          doc.id,
+          createKnowledgeDocumentSourceValue(secretRow),
+          bindKnowledgeDocumentFieldSecretProvenance(exact, field, SECRET)
+        )
+      )
+      const gate = createRegistryContentGate({
+        registry: new ResolvedSecretTraceRegistry([], {
+          userId: ids.aliceId,
+          workspaceId: ids.workspaceId,
+        }),
+        actorUserId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      expect(
+        await observeContentDelivery(gate, () => admitKnowledgeChunks(principal, [captured]))
+      ).toEqual(new Set([doc.chunkId]))
+      expect(gate.project?.(SECRET)).toBe('{{FIXTURE_TOKEN}}')
+      await db.transaction(async (tx) => {
+        const [current] = await tx
+          .update(document)
+          .set({ [field]: 'public' })
+          .where(eq(document.id, doc.id))
+          .returning()
+        await replaceKnowledgeDocumentSecretProvenanceInTx(
+          tx,
+          doc.id,
+          createKnowledgeDocumentSourceValue(current),
+          { status: 'exact', entries: [] }
+        )
+      })
+      expect(await inChat(() => admitKnowledgeChunks(principal, [captured]))).toEqual(new Set())
+    }
+  )
+
+  it('exports clean and legacy originals with chunks through the existing ZIP stream', async () => {
+    const docs = [
+      await seedDocument(),
+      await seedDocument({ name: 'tracked.txt', provenance: { status: 'exact', entries: [] } }),
+    ]
+    const bundle = await exportedBundle()
+    const zip = await JSZip.loadAsync(await archiveBytes(bundle))
+    for (const doc of docs) {
+      const original = Object.values(zip.files).find(
+        (file) => file.name.startsWith(`files/${doc.id}/`) && !file.dir
+      )
+      expect(await original?.async('string')).toBe(doc.content)
+      const lines = await zip.file(`chunks/${doc.id}.ndjson`)?.async('string')
+      expect(JSON.parse(lines?.trim() ?? '{}').content).toBe(doc.content)
+    }
+    expect(zip.file('manifest.json')).not.toBeNull()
+  })
+
+  it.each(['unknown', 'exact', 'corrupt'] as const)(
+    'refuses %s chunk bytes introduced after bundle creation, even outside the original gate context',
+    async (kind) => {
+      const doc = await seedDocument({ original: false })
+      const bundle = await exportedBundle()
+      await db.transaction(async (tx) => {
+        await tx
+          .update(embedding)
+          .set({ content: SECRET, chunkHash: sha256Hex(SECRET) })
+          .where(eq(embedding.id, doc.chunkId))
+        await replaceKnowledgeEmbeddingSecretProvenanceInTx(
+          tx,
+          doc.chunkId,
+          kind === 'corrupt' ? 'previous content' : SECRET,
+          kind === 'exact'
+            ? exact
+            : kind === 'unknown'
+              ? { status: 'unknown' }
+              : { status: 'exact', entries: [] }
+        )
+      })
+      await expect(archiveBytes(bundle)).rejects.toThrow(/provenance|model/i)
+      const emitted: string[] = []
+      await expect(
+        (async () => {
+          for await (const chunk of bundle.chunks(doc.id)) emitted.push(chunk.content)
+        })()
+      ).rejects.toThrow(/provenance|model/i)
+      expect(emitted).toEqual([])
+    }
+  )
+
+  it('refuses an inline original replaced after bundle creation without exposing new bytes', async () => {
+    const doc = await seedDocument()
+    const bundle = await exportedBundle()
+    await db.transaction(async (tx) => {
+      const [row] = await tx
+        .update(document)
+        .set({ fileUrl: `data:text/plain;base64,${Buffer.from(SECRET).toString('base64')}` })
+        .where(eq(document.id, doc.id))
+        .returning()
+      await replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        doc.id,
+        createKnowledgeDocumentSourceValue(row),
+        exact
+      )
+    })
+    await expect(archiveBytes(bundle)).rejects.toThrow(/provenance|model/i)
+  })
+
+  it('preserves authorized human export of the original and chunks', async () => {
+    const doc = await seedDocument({ content: SECRET, provenance: { status: 'unknown' } })
+    const zip = await JSZip.loadAsync(await archiveBytes(await exportedBundle(true)))
+    expect(await zip.file(`chunks/${doc.id}.ndjson`)?.async('string')).toContain(SECRET)
+    const original = Object.values(zip.files).find(
+      (file) => file.name.startsWith(`files/${doc.id}/`) && !file.dir
+    )
+    expect(await original?.async('string')).toBe(SECRET)
+  })
+})
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
index 51f76471c68..230f4b8a92b 100644
--- a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -59,14 +59,25 @@ export async function admitKnowledgeDocuments(
  */
 export async function admitKnowledgeChunks(
   principal: Principal,
-  chunks: readonly { id: string; documentId: string; content: string; value?: unknown }[],
+  chunks: readonly {
+    id: string
+    documentId: string
+    content: string
+    value?: unknown
+    snapshot?: KnowledgeDocumentSnapshot
+  }[],
   options: KnowledgeAdmissionOptions = {}
 ): Promise<Set<string>> {
   const admitted = await admitEach(
     principal,
     chunks,
     async (items) => {
-      const provenance = await classifyKnowledgeChunks(items)
+      const provenance = await classifyKnowledgeChunks(
+        items.map((chunk) => ({
+          ...chunk,
+          snapshot: chunk.snapshot ?? knowledgeDocumentSnapshot(chunk.value ?? chunk),
+        }))
+      )
       return items.map((chunk) => ({
         kind: 'knowledge-chunk' as const,
         id: chunk.id,
diff --git a/apps/sim/lib/knowledge/application/chunks.test.ts b/apps/sim/lib/knowledge/application/chunks.test.ts
index e1bc7198b61..35036aa163c 100644
--- a/apps/sim/lib/knowledge/application/chunks.test.ts
+++ b/apps/sim/lib/knowledge/application/chunks.test.ts
@@ -1,8 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import {
-  createDelegatedPrincipal,
-  createSessionPrincipal,
-} from '@sim/testing/factories/principal.factory'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import {
   knowledgeContextsMock,
   knowledgeContextsMockFns,
@@ -110,57 +107,6 @@ describe('knowledge chunk application use cases', () => {
     expect(item.value).toMatchObject({ documentId: 'document-1', documentName: 'named.txt' })
   })
 
-  describe('a searched chunk listing', () => {
-    const page = {
-      chunks: [
-        { id: 'chunk-1', content: 'first' },
-        { id: 'chunk-2', content: 'second' },
-      ],
-      pagination: { total: 7, limit: 2, offset: 4, hasMore: true },
-    }
-
-    beforeEach(() => {
-      knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue(
-        {
-          workspaceId: 'workspace-1',
-          workspaceOrganizationId: null,
-          allowPersonalApiKeys: true,
-          billedAccountUserId: 'billing-owner-1',
-          access: { get: async () => WORKSPACE_ACCESS_SCOPE },
-          knowledgeBaseId: 'knowledge-1',
-          knowledgeBase: { id: 'knowledge-1' },
-          documentId: 'document-1',
-          document: { id: 'document-1', processingStatus: 'completed', enabled: true },
-        }
-      )
-      mocks.queryChunks.mockResolvedValue(page)
-      admitOnly(['chunk-1'])
-    })
-
-    it('reports Chat a total of the matches it was given, not of withheld ones', async () => {
-      const result = await listKnowledgeChunks.execute({
-        principal: createDelegatedPrincipal({
-          workspaceId: 'workspace-1',
-          audience: 'sim:knowledge',
-        }),
-        input: { knowledgeBaseId: 'knowledge-1', documentId: 'document-1', search: 'token' },
-      })
-
-      expect(result.chunks.map((chunk) => chunk.id)).toEqual(['chunk-1'])
-      expect(result.pagination).toEqual({ total: 5, limit: 2, offset: 4, hasMore: true })
-    })
-
-    it('keeps the full total for a person', async () => {
-      admitOnly(['chunk-1', 'chunk-2'])
-      const result = await listKnowledgeChunks.execute({
-        principal: createSessionPrincipal(),
-        input: { knowledgeBaseId: 'knowledge-1', documentId: 'document-1', search: 'token' },
-      })
-
-      expect(result.pagination).toEqual(page.pagination)
-    })
-  })
-
   it('returns a typed transient failure before querying chunks for a processing document', async () => {
     const promise = listKnowledgeChunks.execute({
       principal: createSessionPrincipal(),
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index 2946faef16d..2e8d37cf5a6 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -1,6 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
-import { ContentRefusedError, isCopilotPrincipal } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -28,6 +28,7 @@ import {
 } from '@/lib/knowledge/chunks/service'
 import type { ChunkFilters } from '@/lib/knowledge/chunks/types'
 import { runWithKnowledgeModelInputProvenance } from '@/lib/knowledge/model-input-provenance'
+import type { KnowledgeDocumentSnapshot } from '@/lib/knowledge/secret-provenance'
 import { calculateCost } from '@/providers/utils'
 
 const logger = createLogger('KnowledgeChunkApplication')
@@ -75,13 +76,17 @@ async function requireAdmittedChunk(
   principal: Principal,
   documentId: string,
   chunk: { id: string; content: string },
-  options: { written?: boolean; shown?: Record<string, unknown> } = {}
+  options: {
+    written?: boolean
+    shown?: Record<string, unknown>
+    snapshot?: KnowledgeDocumentSnapshot
+  } = {}
 ): Promise<void> {
   /** `shown` is every other field the response adds beside the chunk, such as its document name. */
   const value = options.shown ? { ...chunk, ...options.shown } : chunk
   const admitted = await admitKnowledgeChunks(
     principal,
-    [{ id: chunk.id, documentId, content: chunk.content, value }],
+    [{ id: chunk.id, documentId, content: chunk.content, value, snapshot: options.snapshot }],
     { written: options.written }
   )
   if (!options.written && !admitted.has(chunk.id)) throw new ContentRefusedError('knowledge-chunk')
@@ -165,13 +170,6 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
     return {
       ...result,
       chunks,
-      /**
-       * A search total counts every matching chunk, refused ones included, so for Chat it would
-       * say whether withheld text matched. Chat sees only the matches it was given.
-       */
-      ...(filters.search && isCopilotPrincipal(principal)
-        ? { pagination: { ...result.pagination, total: result.pagination.offset + chunks.length } }
-        : {}),
       workspaceId: context.workspaceId,
       documentId,
     }
@@ -244,6 +242,7 @@ export const createKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
     await requireAdmittedChunk(principal, context.documentId, chunk, {
       written: true,
       shown: { documentId: context.documentId, documentName: context.document.filename },
+      snapshot: { filename: context.document.filename },
     })
     return {
       chunk: {
diff --git a/apps/sim/lib/knowledge/application/connectors.test.ts b/apps/sim/lib/knowledge/application/connectors.test.ts
index e6c1b635328..630893c5e51 100644
--- a/apps/sim/lib/knowledge/application/connectors.test.ts
+++ b/apps/sim/lib/knowledge/application/connectors.test.ts
@@ -1,5 +1,5 @@
 import { member } from '@sim/db/schema'
-import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import { authOAuthUtilsMock, authOAuthUtilsMockFns } from '@sim/testing/mocks/auth-oauth-utils.mock'
@@ -116,7 +116,6 @@ import * as encryption from '@/lib/core/security/encryption'
 import {
   createKnowledgeConnector,
   deleteKnowledgeConnector,
-  listKnowledgeConnectorDocuments,
   resolveConnectorCredentialAccessToken,
   syncKnowledgeConnector,
   updateKnowledgeConnector,
@@ -310,39 +309,6 @@ describe('knowledge connector application use cases', () => {
 
   afterAll(resetDbChainMock)
 
-  describe('a searched connector document listing', () => {
-    /** The statements the listing ran whose conditions bind the search pattern. */
-    function searchedStatements(): number {
-      return dbChainMockFns.where.mock.calls.filter(([condition]) =>
-        JSON.stringify(condition, (_key, value) =>
-          value && typeof value.toSQL === 'function' ? value.toSQL() : value
-        ).includes('%report%')
-      ).length
-    }
-
-    async function list(
-      principal: Parameters<typeof listKnowledgeConnectorDocuments.execute>[0]['principal']
-    ) {
-      queueTableRows(schemaMock.document, [{ active: 4, excluded: 1, failed: 0, skipped: 0 }])
-      queueTableRows(schemaMock.document, [])
-      return listKnowledgeConnectorDocuments.execute({
-        principal,
-        input: { knowledgeBaseId: 'knowledge-b', connectorId: 'connector-b', search: 'report' },
-      })
-    }
-
-    it('counts the whole source for Chat, so withheld names cannot answer the search', async () => {
-      workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('read')
-      await list({ ...delegatedPrincipal, workspaceId: 'workspace-b' })
-      expect(searchedStatements()).toBe(1)
-    })
-
-    it('counts only the matches for a person, as before', async () => {
-      await list(createSessionPrincipal())
-      expect(searchedStatements()).toBe(2)
-    })
-  })
-
   it('rejects a forged OAuth credential for central Drive creation before using its token', async () => {
     workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('admin')
     knowledgeContextsMockFns.mockResolveActiveKnowledgeBaseContext.mockResolvedValue({
diff --git a/apps/sim/lib/knowledge/application/connectors.ts b/apps/sim/lib/knowledge/application/connectors.ts
index c601bbeafa7..b60670c0b40 100644
--- a/apps/sim/lib/knowledge/application/connectors.ts
+++ b/apps/sim/lib/knowledge/application/connectors.ts
@@ -16,7 +16,6 @@ import { and, asc, desc, eq, inArray, isNull, lt, or, sql } from 'drizzle-orm'
 import type { ConnectorDocumentFilter } from '@/lib/api/contracts/knowledge/connectors'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
 import { requireCurrentHumanRole } from '@/lib/core/application'
-import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { resolvePrincipalEnvironmentVariable } from '@/lib/core/application/environment-reference'
 import { requireOrganizationMembership } from '@/lib/core/application/organization-authorization'
 import {
@@ -1230,11 +1229,6 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
       ? sql`${document.filename} ILIKE ${`%${escapeLikePattern(search)}%`} ESCAPE '\\'`
       : undefined
     const baseConditions = [...scopeConditions, searchCondition] as const
-    /**
-     * Searched counts include documents Chat is refused, so they would say whether a withheld name
-     * matched; Chat's counts cover the whole source, as an unsearched listing reports them.
-     */
-    const countConditions = isCopilotPrincipal(principal) ? scopeConditions : baseConditions
     const active = sql`${document.userExcluded} = false`
     /** One pass over the source's readable documents; excluded rows are scanned only when counted. */
     const [[counts], rows] = await Promise.all([
@@ -1248,7 +1242,7 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
         .from(document)
         .where(
           and(
-            ...countConditions,
+            ...baseConditions,
             input.filter || input.includeExcluded ? undefined : eq(document.userExcluded, false)
           )
         ),
diff --git a/apps/sim/lib/knowledge/application/documents.test.ts b/apps/sim/lib/knowledge/application/documents.test.ts
index 07d1adbe6a4..063f56e12a5 100644
--- a/apps/sim/lib/knowledge/application/documents.test.ts
+++ b/apps/sim/lib/knowledge/application/documents.test.ts
@@ -294,49 +294,6 @@ describe('knowledge document application use cases', () => {
     expect(mocks.deleteDocumentById).not.toHaveBeenCalled()
   })
 
-  describe('a filtered document listing', () => {
-    const page = {
-      documents: [{ id: 'document-1' }, { id: 'withheld-1' }],
-      pagination: { total: 9, limit: 2, offset: 2, hasMore: true },
-    }
-    const chat = {
-      kind: 'delegated' as const,
-      serviceId: 'copilot',
-      subjectUserId: 'user-1',
-      workspaceId: 'workspace-1',
-      delegationId: 'tool-call-1',
-      audience: 'sim:knowledge',
-      issuedAt: new Date(),
-      expiresAt: new Date(Date.now() + 60_000),
-    }
-    const input = { knowledgeBaseId: 'knowledge-1', limit: 2, offset: 2, search: 'secret' }
-
-    beforeEach(() => {
-      mocks.getDocuments.mockResolvedValue(page)
-    })
-
-    it('reports Chat a total of the matches it was given, not of withheld ones', async () => {
-      const result = await listKnowledgeDocuments.execute({ principal: chat, input })
-
-      expect(result.documents.map((doc: { id: string }) => doc.id)).toEqual(['document-1'])
-      expect(result.pagination).toEqual({ total: 3, limit: 2, offset: 2, hasMore: true })
-    })
-
-    it('keeps the full total for a person and for Chat without a filter', async () => {
-      const person = await listKnowledgeDocuments.execute({
-        principal: createSessionPrincipal(),
-        input,
-      })
-      expect(person.pagination).toEqual(page.pagination)
-
-      const unfiltered = await listKnowledgeDocuments.execute({
-        principal: chat,
-        input: { knowledgeBaseId: 'knowledge-1', limit: 2, offset: 2 },
-      })
-      expect(unfiltered.pagination).toEqual(page.pagination)
-    })
-  })
-
   it('authorizes the canonical knowledge base before listing documents', async () => {
     await listKnowledgeDocuments.execute({
       principal: createSessionPrincipal(),
diff --git a/apps/sim/lib/knowledge/application/documents.ts b/apps/sim/lib/knowledge/application/documents.ts
index b8071b74675..e5bcbdc8883 100644
--- a/apps/sim/lib/knowledge/application/documents.ts
+++ b/apps/sim/lib/knowledge/application/documents.ts
@@ -9,11 +9,7 @@ import {
   checkAttributedUsageLimits,
 } from '@/lib/billing/core/billing-attribution'
 import { authorizeWorkspaceOperation } from '@/lib/core/application'
-import {
-  admitContent,
-  ContentRefusedError,
-  isCopilotPrincipal,
-} from '@/lib/core/application/content-delivery'
+import { admitContent, ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
@@ -328,17 +324,9 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
       result.documents.map((doc) => ({ id: doc.id, value: doc }))
     )
     const documents = result.documents.filter((doc) => admitted.has(doc.id))
-    /**
-     * A filtered total counts every matching document, refused ones included, so for Chat it would
-     * say whether withheld names or tag values matched. Chat sees only the matches it was given.
-     */
-    const filtered = Boolean(input.search) || tagFilters.length > 0
     return {
       ...result,
       documents,
-      ...(filtered && isCopilotPrincipal(principal)
-        ? { pagination: { ...result.pagination, total: offset + documents.length } }
-        : {}),
       tagDefinitions:
         resolvedNameFilters?.definitionsByKnowledgeBase.get(context.knowledgeBaseId) ??
         (await getDocumentTagDefinitions(context.knowledgeBaseId)),
diff --git a/apps/sim/lib/knowledge/application/exports.ts b/apps/sim/lib/knowledge/application/exports.ts
index 646374f806c..f1d91b49fe0 100644
--- a/apps/sim/lib/knowledge/application/exports.ts
+++ b/apps/sim/lib/knowledge/application/exports.ts
@@ -1,10 +1,23 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { Readable } from 'node:stream'
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  ContentRefusedError,
+  mustClassifyContent,
+  requireAdmittedContent,
+} from '@/lib/core/application/content-delivery'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveActiveKnowledgeBaseContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { KNOWLEDGE_BUNDLE_VERSION } from '@/lib/knowledge/constants'
 import { toKbEmbeddingDimensions } from '@/lib/knowledge/embedding-models'
+import {
+  classifyKnowledgeChunks,
+  classifyKnowledgeDocumentMetadata,
+  loadKnowledgeDocumentDurableSecretProvenance,
+} from '@/lib/knowledge/secret-provenance'
 import {
   bundleEntryPaths,
   type KnowledgeBundleManifest,
@@ -12,6 +25,7 @@ import {
   parseDescribableBundle,
   toManifestDocument,
 } from '@/lib/knowledge/transfer/bundle'
+import { openKnowledgeExportFile } from '@/lib/knowledge/transfer/export-archive'
 import {
   type ExportableChunk,
   type ExportableDocument,
@@ -38,6 +52,7 @@ export interface KnowledgeBaseExportBundle {
   embedding: KnowledgeBundleManifest['embedding']
   tags: KnowledgeBundleTag[]
   documents: ExportableDocument[]
+  file(document: ExportableDocument): Promise<Readable | Buffer>
   chunks(documentId: string): AsyncIterable<ExportableChunk>
 }
 
@@ -50,13 +65,22 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ExportKnowledgeBaseInput
   }) => resolveActiveKnowledgeBaseContext(input, principal),
-  async execute({ input, context }): Promise<KnowledgeBaseExportBundle> {
+  async execute({ principal, input, context }): Promise<KnowledgeBaseExportBundle> {
     const { knowledgeBase } = context
     const dimension = toKbEmbeddingDimensions(knowledgeBase.embeddingDimension)
     const [tags, documents] = await Promise.all([
       listExportableTags(knowledgeBase.id),
       listExportableDocuments(knowledgeBase.id),
     ])
+    const classify = mustClassifyContent(principal)
+    const inExportContext = AsyncLocalStorage.snapshot()
+    const documentById = new Map(documents.map((document) => [document.id, document]))
+    const snapshot = (document: ExportableDocument) => ({
+      filename: document.filename,
+      ...document.tags,
+    })
+    // Deferred bytes are admitted in the captured context as their stream reaches each source.
+    await admitContent(principal, [])
     const manifest = parseDescribableBundle({
       version: KNOWLEDGE_BUNDLE_VERSION,
       exportedAt: new Date().toISOString(),
@@ -80,8 +104,69 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
       embedding: manifest.embedding,
       tags: manifest.tags,
       documents,
-      chunks: (documentId) =>
-        iterateDocumentChunks(knowledgeBase.id, documentId, input.vectors ? dimension : null),
+      file: (document) =>
+        inExportContext(async () => {
+          if (!document.file) throw new ContentRefusedError('knowledge-document')
+          if (!classify) return openKnowledgeExportFile(document.file)
+          const current = await loadKnowledgeDocumentDurableSecretProvenance(
+            document.id,
+            snapshot(document)
+          )
+          if (
+            current.knowledgeBaseId !== knowledgeBase.id ||
+            (document.file.kind === 'storage' && current.storageKey !== document.file.key) ||
+            (document.file.kind === 'data-uri' && current.storageKey !== null)
+          ) {
+            throw new ContentRefusedError('knowledge-document')
+          }
+          await requireAdmittedContent(principal, {
+            kind: 'knowledge-document',
+            id: document.id,
+            provenance: current.provenance,
+            view: 'opaque',
+          })
+          return openKnowledgeExportFile(document.file, current.source.fileUrl)
+        }),
+      chunks: async function* (documentId) {
+        const document = documentById.get(documentId)
+        if (!document) throw new ContentRefusedError('knowledge-document')
+        if (classify) {
+          await inExportContext(async () => {
+            const provenance = await classifyKnowledgeDocumentMetadata(
+              [documentId],
+              new Map([[documentId, [snapshot(document)]]])
+            )
+            await requireAdmittedContent(principal, {
+              kind: 'knowledge-document',
+              id: documentId,
+              provenance: provenance.get(documentId) ?? { status: 'unknown' },
+              view: 'opaque',
+            })
+          })
+        }
+        yield* iterateDocumentChunks(
+          knowledgeBase.id,
+          documentId,
+          input.vectors ? dimension : null,
+          classify
+            ? (page) =>
+                inExportContext(async () => {
+                  const provenance = await classifyKnowledgeChunks(
+                    page.map((chunk) => ({ ...chunk, documentId }))
+                  )
+                  const sources = page.map((chunk) => ({
+                    kind: 'knowledge-chunk' as const,
+                    id: chunk.id,
+                    provenance: provenance.get(chunk.id) ?? { status: 'unknown' as const },
+                    view: 'opaque' as const,
+                  }))
+                  if ((await admitContent(principal, sources)).refused.length > 0) {
+                    throw new ContentRefusedError('knowledge-chunk')
+                  }
+                })
+            : undefined
+        )
+      },
     }
   },
   projectAudit: ({ context, input, result }) => ({
diff --git a/apps/sim/lib/knowledge/application/operations.ts b/apps/sim/lib/knowledge/application/operations.ts
index 4286bf6a175..b3f3cc58ad6 100644
--- a/apps/sim/lib/knowledge/application/operations.ts
+++ b/apps/sim/lib/knowledge/application/operations.ts
@@ -96,14 +96,6 @@ const ALL_PRINCIPAL_WITH_EXECUTOR_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 
-/**
- * Callers acting for themselves. A whole-base archive is opaque bytes no per-chunk secret
- * redaction reaches, so Chat is not delegated to it; it reads a base chunk by chunk instead.
- */
-const DIRECT_PRINCIPAL_POLICY = {
-  principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'workspace_api_key'],
-} as const
-
 const HUMAN_AND_DELEGATED_PRINCIPAL_KINDS = [
   'session',
   'personal_api_key',
@@ -312,7 +304,8 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.export',
-      ...DIRECT_PRINCIPAL_POLICY,
+      contentDelivery: 'sourced',
+      ...ALL_PRINCIPAL_POLICY,
     })
   ),
   /**
@@ -667,7 +660,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
-      contentDelivery: 'sourced',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
diff --git a/apps/sim/lib/knowledge/application/tags.test.ts b/apps/sim/lib/knowledge/application/tags.test.ts
index 3c0bc2503dd..f8ededfacc3 100644
--- a/apps/sim/lib/knowledge/application/tags.test.ts
+++ b/apps/sim/lib/knowledge/application/tags.test.ts
@@ -1,6 +1,8 @@
 import type { Principal } from '@sim/auth/principal'
-import { queueTableRows, schemaMock } from '@sim/testing'
-import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import {
+  createDelegatedPrincipal,
+  createSessionPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import {
   knowledgeContextsMock,
@@ -81,17 +83,13 @@ const documentContext = {
 
 const sessionPrincipal = createSessionPrincipal()
 
-const delegatedPrincipal = {
-  kind: 'delegated' as const,
-  serviceId: 'copilot',
+const delegatedPrincipal = createDelegatedPrincipal({
   subjectUserId: 'shared-user',
   workspaceId: 'workspace-a',
   delegationId: 'tool-call-1',
   audience: 'sim:knowledge',
-  issuedAt: new Date(),
-  expiresAt: new Date(Date.now() + 60_000),
   resourceScope: {},
-}
+})
 
 const mocks = {
   listTags: knowledgeTagsServiceMockFns.mockGetDocumentTagDefinitions,
@@ -124,63 +122,73 @@ describe('knowledge tag application use cases', () => {
   })
 
   it.each([
-    [
-      'list',
-      listKnowledgeTags,
-      { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
-    ],
-    [
-      'create',
-      createKnowledgeTag,
-      {
-        knowledgeBaseId: 'knowledge-b',
-        assertedWorkspaceId: 'workspace-a',
-        displayName: 'Region',
-      },
-    ],
-    [
-      'update',
-      updateKnowledgeTag,
-      {
-        tagDefinitionId: 'tag-b',
-        assertedWorkspaceId: 'workspace-a',
-        updates: { displayName: 'Market' },
-      },
-    ],
-    [
-      'delete',
-      deleteKnowledgeTag,
-      {
-        knowledgeBaseId: 'knowledge-b',
-        tagDefinitionId: 'tag-b',
-        assertedWorkspaceId: 'workspace-a',
-      },
-    ],
-    [
-      'read usage',
-      readKnowledgeTagUsage,
-      { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
-    ],
-  ])(
-    'rejects cross-workspace %s before current membership or tag work',
-    async (_name, useCase, input) => {
-      await expect(useCase.execute({ principal: delegatedPrincipal, input })).rejects.toMatchObject(
-        {
-          name: 'DelegatedWorkspaceAuthorizationError',
-          code: 'forbidden',
-        }
-      )
+    {
+      name: 'list',
+      run: () =>
+        listKnowledgeTags.execute({
+          principal: delegatedPrincipal,
+          input: { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
+        }),
+    },
+    {
+      name: 'create',
+      run: () =>
+        createKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            knowledgeBaseId: 'knowledge-b',
+            assertedWorkspaceId: 'workspace-a',
+            displayName: 'Region',
+          },
+        }),
+    },
+    {
+      name: 'update',
+      run: () =>
+        updateKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            tagDefinitionId: 'tag-b',
+            assertedWorkspaceId: 'workspace-a',
+            updates: { displayName: 'Market' },
+          },
+        }),
+    },
+    {
+      name: 'delete',
+      run: () =>
+        deleteKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            knowledgeBaseId: 'knowledge-b',
+            tagDefinitionId: 'tag-b',
+            assertedWorkspaceId: 'workspace-a',
+          },
+        }),
+    },
+    {
+      name: 'read usage',
+      run: () =>
+        readKnowledgeTagUsage.execute({
+          principal: delegatedPrincipal,
+          input: { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
+        }),
+    },
+  ])('rejects cross-workspace $name before current membership or tag work', async ({ run }) => {
+    await expect(run()).rejects.toMatchObject({
+      name: 'DelegatedWorkspaceAuthorizationError',
+      code: 'forbidden',
+    })
 
-      expect(mocks.resolvePermission).not.toHaveBeenCalled()
-      expect(mocks.listTags).not.toHaveBeenCalled()
-      expect(mocks.nextSlot).not.toHaveBeenCalled()
-      expect(mocks.createTag).not.toHaveBeenCalled()
-      expect(mocks.updateTag).not.toHaveBeenCalled()
-      expect(mocks.deleteTag).not.toHaveBeenCalled()
-      expect(mocks.readUsage).not.toHaveBeenCalled()
-      expect(mocks.recordAudit).not.toHaveBeenCalled()
-    }
-  )
+    expect(mocks.resolvePermission).not.toHaveBeenCalled()
+    expect(mocks.listTags).not.toHaveBeenCalled()
+    expect(mocks.nextSlot).not.toHaveBeenCalled()
+    expect(mocks.createTag).not.toHaveBeenCalled()
+    expect(mocks.updateTag).not.toHaveBeenCalled()
+    expect(mocks.deleteTag).not.toHaveBeenCalled()
+    expect(mocks.readUsage).not.toHaveBeenCalled()
+    expect(mocks.recordAudit).not.toHaveBeenCalled()
+  })
 
   it.each([
     ['an unknown slot', { tagSlot: 'tag99', fieldType: 'text' }],
@@ -434,38 +442,6 @@ describe('knowledge tag application use cases', () => {
       expect(result.usage[1]).toBe(detailed[1])
     })
 
-    it('counts for Chat only the documents it may see, chunks included', async () => {
-      mocks.readUsage.mockResolvedValue([
-        {
-          id: 'def-1',
-          tagSlot: 'tag1',
-          displayName: 'Region',
-          fieldType: 'text',
-          documentCount: 2,
-          chunkCount: 9,
-        },
-        {
-          id: 'def-2',
-          tagSlot: 'tag2',
-          displayName: 'Owner',
-          fieldType: 'text',
-          documentCount: 1,
-          chunkCount: 4,
-        },
-      ])
-      queueTableRows(schemaMock.embedding, [{ documentId: 'doc-shared', count: 4 }])
-
-      const result = await readKnowledgeTagUsage.execute({
-        principal: chat,
-        input: { knowledgeBaseId: 'knowledge-b' },
-      })
-
-      expect(result.usage).toEqual([
-        expect.objectContaining({ tagSlot: 'tag1', documentCount: 1, chunkCount: 5 }),
-        expect.objectContaining({ tagSlot: 'tag2', documentCount: 1, chunkCount: 4 }),
-      ])
-    })
-
     it('leaves a person’s counts as stored, without reading documents', async () => {
       const stats = [
         {
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index 90958d6a418..24a36745258 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -1,10 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
-import { db } from '@sim/db'
-import { embedding } from '@sim/db/schema'
 import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
-import { inArray, sql } from 'drizzle-orm'
-import { admitContent, isCopilotPrincipal } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
@@ -389,42 +386,9 @@ export const readKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
     resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ principal, context }) {
-    const requestId = generateRequestId()
-    const usage = await getTagUsageStats(context.knowledgeBaseId, context.access, requestId)
-    if (!isCopilotPrincipal(principal)) {
-      await admitContent(principal, [])
-      return { usage }
-    }
-    /**
-     * A count says which documents carry a tag, so for Chat each definition counts only the
-     * documents it may see; a withheld document's chunks leave its chunk count with it.
-     */
-    const detailed = await getTagUsage(context.knowledgeBaseId, requestId, context.access)
-    const visible = await admitTagUsage(principal, detailed)
-    const withheld = new Map<string, string[]>()
-    detailed.forEach((definition, index) => {
-      const kept = new Set(visible[index].documents.map((doc) => doc.id))
-      const refused = definition.documents.filter((doc) => !kept.has(doc.id)).map((doc) => doc.id)
-      if (refused.length > 0) withheld.set(definition.tagSlot, refused)
-    })
-    if (withheld.size === 0) return { usage }
-    const chunkCounts = await countKnowledgeDocumentChunks([
-      ...new Set([...withheld.values()].flat()),
-    ])
+  async execute({ context }) {
     return {
-      usage: usage.map((stat) => {
-        const refused = withheld.get(stat.tagSlot)
-        if (!refused) return stat
-        return {
-          ...stat,
-          documentCount: Math.max(0, stat.documentCount - refused.length),
-          chunkCount: Math.max(
-            0,
-            stat.chunkCount - refused.reduce((sum, id) => sum + (chunkCounts.get(id) ?? 0), 0)
-          ),
-        }
-      }),
+      usage: await getTagUsageStats(context.knowledgeBaseId, context.access, generateRequestId()),
     }
   },
 })
@@ -439,17 +403,6 @@ export const readDetailedKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   },
 })
 
-/** Chunks per document, for the documents a tag count withholds. */
-async function countKnowledgeDocumentChunks(documentIds: string[]): Promise<Map<string, number>> {
-  if (documentIds.length === 0) return new Map()
-  const rows = await db
-    .select({ documentId: embedding.documentId, count: sql<number>`count(*)::int` })
-    .from(embedding)
-    .where(inArray(embedding.documentId, documentIds))
-    .groupBy(embedding.documentId)
-  return new Map(rows.map((row) => [row.documentId, Number(row.count)]))
-}
-
 export const readNextKnowledgeTagSlot = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readNextTagSlot,
   resolveContext: ({
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index 89e575464f2..e882b3cd610 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -6,7 +6,7 @@ import {
   embeddingSecretProvenance,
 } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
-import { and, eq, inArray, isNull, type SQL } from 'drizzle-orm'
+import { and, eq, inArray, isNull, type SQL, sql } from 'drizzle-orm'
 import type { DbTransaction } from '@/lib/db/types'
 import {
   bindDurableSecretProvenanceToValue,
@@ -184,6 +184,8 @@ interface KnowledgeEmbeddingSecretProvenanceRow {
 
 const KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION = {
   id: document.id,
+  knowledgeBaseId: document.knowledgeBaseId,
+  storageKey: document.storageKey,
   secretProvenanceVersion: document.secretProvenanceVersion,
   filename: document.filename,
   fileUrl: document.fileUrl,
@@ -222,9 +224,18 @@ const KNOWLEDGE_EMBEDDING_PROVENANCE_SELECTION = {
   entries: embeddingSecretProvenance.entries,
 }
 
-function selectKnowledgeDocumentProvenanceRows(where: SQL<unknown> | undefined) {
+function selectKnowledgeDocumentProvenanceRows(
+  where: SQL<unknown> | undefined,
+  deferInlineContent = false
+) {
   return db
-    .select(KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION)
+    .select({
+      ...KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION,
+      fileUrl: deferInlineContent
+        ? sql<string>`CASE WHEN ${document.fileUrl} LIKE 'data:%' THEN '' ELSE ${document.fileUrl} END`
+        : document.fileUrl,
+      hasInlineFile: sql<boolean>`${document.fileUrl} LIKE 'data:%'`,
+    })
     .from(document)
     .leftJoin(documentSecretProvenance, eq(documentSecretProvenance.documentId, document.id))
     .where(where)
@@ -439,17 +450,13 @@ export async function loadKnowledgeDocumentSecretRegistry(
   return { registry, provenance, tracked: true }
 }
 
-/**
- * Classifies the rendered metadata (name, source URL, tags, typed fields) of each document, one
- * statement for all of them. A document that is gone, or whose binding no longer matches its row,
- * reads as unknown.
- */
 /**
  * Metadata fields a person can edit in place that can hold text, which a returned snapshot is
  * checked against. Date and boolean slots are typed columns no secret text can occupy.
  */
 const EDITABLE_DOCUMENT_FIELDS = [
   'filename',
+  'sourceUrl',
   'tag1',
   'tag2',
   'tag3',
@@ -484,6 +491,15 @@ function sameField(stored: unknown, shown: unknown): boolean {
   return typeof stored === 'number' && Number(right) === stored
 }
 
+function matchesDocumentSnapshot(
+  source: KnowledgeDocumentSourceValue,
+  snapshot: KnowledgeDocumentSnapshot
+): boolean {
+  return Object.entries(snapshot).every(
+    ([field, shown]) => !isEditableField(field) || sameField(Reflect.get(source, field), shown)
+  )
+}
+
 /** Picks the editable metadata a returned value shows, when it shows any. */
 export function knowledgeDocumentSnapshot(value: unknown): KnowledgeDocumentSnapshot | undefined {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined
@@ -501,7 +517,8 @@ export function knowledgeDocumentSnapshot(value: unknown): KnowledgeDocumentSnap
 /**
  * Classifies the rendered metadata of each document. A document whose stored metadata no longer
  * matches a snapshot the result shows reads as unknown: a concurrent edit must not pair the old
- * values, which the result still carries, with the new row's classification.
+ * values, which the result still carries, with the new row's classification. Inline originals
+ * needed for tracked bindings are loaded one at a time, never materialized as a metadata page.
  */
 export async function classifyKnowledgeDocumentMetadata(
   documentIds: readonly string[],
@@ -509,15 +526,21 @@ export async function classifyKnowledgeDocumentMetadata(
 ): Promise<Map<string, DurableSecretProvenance>> {
   const ids = [...new Set(documentIds)]
   const rows = ids.length
-    ? await selectKnowledgeDocumentProvenanceRows(inArray(document.id, ids))
+    ? await selectKnowledgeDocumentProvenanceRows(inArray(document.id, ids), true)
     : []
   const result = new Map<string, DurableSecretProvenance>()
-  for (const row of rows) {
+  for (const metadata of rows) {
+    const row =
+      metadata.hasInlineFile && metadata.secretProvenanceVersion !== null
+        ? (await selectKnowledgeDocumentProvenanceRows(eq(document.id, metadata.id)).limit(1))[0]
+        : metadata
+    if (!row) {
+      result.set(metadata.id, { status: 'unknown' })
+      continue
+    }
     const source = createKnowledgeDocumentSourceValue(row)
-    const stale = (snapshots?.get(row.id) ?? []).some((snapshot) =>
-      Object.entries(snapshot).some(
-        ([field, shown]) => isEditableField(field) && !sameField(Reflect.get(source, field), shown)
-      )
+    const stale = (snapshots?.get(row.id) ?? []).some(
+      (snapshot) => !matchesDocumentSnapshot(source, snapshot)
     )
     result.set(
       row.id,
@@ -536,15 +559,32 @@ export async function classifyKnowledgeDocumentMetadata(
 /**
  * Classifies each chunk a result returns: its own content's binding, merged with the metadata of
  * the document whose tags the chunk carries. A chunk whose row moved since it was read (other
- * document, other content) reads as unknown. Two statements for any number of chunks.
+ * document, other content) reads as unknown. Chunk rows and document metadata are batched;
+ * tracked inline document sources are loaded individually to verify their bindings.
  */
 export async function classifyKnowledgeChunks(
-  chunks: readonly { id: string; documentId: string; content: string }[]
+  chunks: readonly {
+    id: string
+    documentId: string
+    content: string
+    snapshot?: KnowledgeDocumentSnapshot
+  }[]
 ): Promise<Map<string, DurableSecretProvenance>> {
+  const snapshots = new Map<string, KnowledgeDocumentSnapshot[]>()
+  for (const chunk of chunks) {
+    if (chunk.snapshot) {
+      const current = snapshots.get(chunk.documentId)
+      if (current) current.push(chunk.snapshot)
+      else snapshots.set(chunk.documentId, [chunk.snapshot])
+    }
+  }
   const ids = [...new Set(chunks.map((chunk) => chunk.id))]
   const [rows, documents] = await Promise.all([
     ids.length ? selectKnowledgeEmbeddingProvenanceRows(inArray(embedding.id, ids)) : [],
-    classifyKnowledgeDocumentMetadata(chunks.map((chunk) => chunk.documentId)),
+    classifyKnowledgeDocumentMetadata(
+      chunks.map((chunk) => chunk.documentId),
+      snapshots
+    ),
   ])
   const rowById = new Map(rows.map((row) => [row.id, row]))
   return new Map(
@@ -565,7 +605,12 @@ export async function classifyKnowledgeChunks(
 }
 
 /** Loads the bound document classification for copy/re-entry callers that do not need a registry. */
-export async function loadKnowledgeDocumentDurableSecretProvenance(documentId: string): Promise<{
+export async function loadKnowledgeDocumentDurableSecretProvenance(
+  documentId: string,
+  snapshot?: KnowledgeDocumentSnapshot
+): Promise<{
+  knowledgeBaseId: string
+  storageKey: string | null
   source: KnowledgeDocumentSourceValue
   provenance: DurableSecretProvenance
   tracked: boolean
@@ -574,8 +619,13 @@ export async function loadKnowledgeDocumentDurableSecretProvenance(documentId: s
   if (!row) throw new Error('Document not found')
   const source = createKnowledgeDocumentSourceValue(row)
   return {
+    knowledgeBaseId: row.knowledgeBaseId,
+    storageKey: row.storageKey,
     source,
-    provenance: readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
+    provenance:
+      snapshot && !matchesDocumentSnapshot(source, snapshot)
+        ? { status: 'unknown' }
+        : readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
     tracked: row.secretProvenanceVersion === 1,
   }
 }
diff --git a/apps/sim/lib/knowledge/transfer/export-archive.test.ts b/apps/sim/lib/knowledge/transfer/export-archive.test.ts
index d087ec59bea..7bee0ddafdc 100644
--- a/apps/sim/lib/knowledge/transfer/export-archive.test.ts
+++ b/apps/sim/lib/knowledge/transfer/export-archive.test.ts
@@ -23,6 +23,7 @@ import { MAX_DOCUMENT_CHUNKS } from '@/lib/knowledge/documents/document-processi
 import {
   buildKnowledgeBundleArchive,
   knowledgeBundleFileName,
+  openKnowledgeExportFile,
 } from '@/lib/knowledge/transfer/export-archive'
 import type { ExportableChunk, ExportableDocument } from '@/lib/knowledge/transfer/export-source'
 
@@ -82,6 +83,10 @@ function bundle(overrides: Partial<KnowledgeBaseExportBundle> = {}): KnowledgeBa
       }),
       exportableDocument({ id: TEXT_ONLY_ID, filename: 'wiki page', file: null }),
     ],
+    file: (document) => {
+      if (!document.file) throw new Error('Fixture has no original')
+      return openKnowledgeExportFile(document.file)
+    },
     chunks: (documentId) =>
       documentId === STORED_ID
         ? chunksOf(chunk(0, [0.25, 0.5]), chunk(1, [1, 2]))
diff --git a/apps/sim/lib/knowledge/transfer/export-archive.ts b/apps/sim/lib/knowledge/transfer/export-archive.ts
index 1185abb6d55..1a8a2f97f34 100644
--- a/apps/sim/lib/knowledge/transfer/export-archive.ts
+++ b/apps/sim/lib/knowledge/transfer/export-archive.ts
@@ -37,12 +37,16 @@ export function knowledgeBundleFileName(knowledgeBaseName: string): string {
   return `${safeBundleLeafName(knowledgeBaseName)}.simkb.zip`
 }
 
-async function openFileSource(source: ExportableFileSource): Promise<Readable | Buffer> {
+/** Opens one captured original; inline bytes can be supplied from their classified row snapshot. */
+export async function openKnowledgeExportFile(
+  source: ExportableFileSource,
+  inlineFileUrl?: string
+): Promise<Readable | Buffer> {
   if (source.kind === 'storage') {
     return downloadFileStream({ key: source.key, context: 'knowledge-base' })
   }
   return decodeDataUriWithinLimit(
-    await readInlineFileUrl(source.knowledgeBaseId, source.documentId),
+    inlineFileUrl ?? (await readInlineFileUrl(source.knowledgeBaseId, source.documentId)),
     MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE
   ).buffer
 }
@@ -149,7 +153,7 @@ async function appendBundleEntries(
   for (const document of bundle.documents) {
     const entries = bundleEntryPaths(document)
     if (document.file && entries.file) {
-      await appendEntry(archive, await openFileSource(document.file), entries.file, closed)
+      await appendEntry(archive, await bundle.file(document), entries.file, closed)
     }
     const chunkCount = entries.chunks
       ? await appendChunkEntry(
diff --git a/apps/sim/lib/knowledge/transfer/export-source.ts b/apps/sim/lib/knowledge/transfer/export-source.ts
index c2e5ca0844a..def2ee496a8 100644
--- a/apps/sim/lib/knowledge/transfer/export-source.ts
+++ b/apps/sim/lib/knowledge/transfer/export-source.ts
@@ -185,13 +185,15 @@ export async function listExportableDocuments(
 export async function* iterateDocumentChunks(
   knowledgeBaseId: string,
   documentId: string,
-  dimensions: KbEmbeddingDimensions | null
+  dimensions: KbEmbeddingDimensions | null,
+  admitPage?: (chunks: readonly (ExportableChunk & { id: string })[]) => Promise<void>
 ): AsyncGenerator<ExportableChunk> {
   const pageSize = dimensions ? CHUNK_PAGE_SIZE.vectors : CHUNK_PAGE_SIZE.text
   let after: number | null = null
   for (;;) {
     const page = await db
       .select({
+        id: embedding.id,
         index: embedding.chunkIndex,
         content: embedding.content,
         tokenCount: embedding.tokenCount,
@@ -211,7 +213,8 @@ export async function* iterateDocumentChunks(
       .orderBy(asc(embedding.chunkIndex))
       .limit(pageSize)
 
-    yield* page
+    await admitPage?.(page)
+    for (const { id: _id, ...chunk } of page) yield chunk
     if (page.length < pageSize) break
     after = page[page.length - 1].index
   }
diff --git a/apps/sim/lib/media/ffmpeg-content.integration.ts b/apps/sim/lib/media/ffmpeg-content.integration.ts
new file mode 100644
index 00000000000..8b3a119f0f6
--- /dev/null
+++ b/apps/sim/lib/media/ffmpeg-content.integration.ts
@@ -0,0 +1,248 @@
+/** Real file versions, storage, and output lineage around the media-processing boundary. */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import * as audit from '@sim/audit'
+import { db } from '@sim/db'
+import { auditLog, organization, user, workspace } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import type { FfmpegOperation, MediaFile } from '@/lib/media/ffmpeg'
+import { ffmpegServerTool } from '@/lib/mothership/tools/server/media/ffmpeg'
+import * as workspaceReader from '@/lib/uploads/contexts/workspace'
+import {
+  fetchWorkspaceFileBuffer,
+  getWorkspaceFile,
+  updateWorkspaceFileContent,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import {
+  getBoundWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/lib/media/ffmpeg', () => ({
+  runFfmpegOperation: async (_operation: FfmpegOperation, inputs: MediaFile[]) => ({
+    buffer: inputs[0].buffer,
+    ext: 'bin',
+    contentType: 'application/octet-stream',
+  }),
+}))
+
+const ids = createKnowledgeAclFixtureIds()
+const SECRET = 'fixture-media-token-847159'
+const CLEAN = { status: 'exact', entries: [] } as const
+let known: WorkspaceFileSecretProvenance
+let submittedAudits = 0
+
+async function drainAudits() {
+  await vi.waitFor(async () =>
+    expect(
+      await db
+        .select({ id: auditLog.id })
+        .from(auditLog)
+        .where(eq(auditLog.workspaceId, ids.workspaceId))
+    ).toHaveLength(submittedAudits)
+  )
+}
+
+async function replace(fileId: string, content: string, provenance: WorkspaceFileSecretProvenance) {
+  return updateWorkspaceFileContent(
+    ids.workspaceId,
+    fileId,
+    ids.aliceId,
+    Buffer.from(content),
+    undefined,
+    {
+      version: { source: 'api', authorUserId: ids.aliceId },
+      secretProvenancePolicy: { mode: 'replace', provenance },
+    }
+  )
+}
+
+beforeAll(async () => {
+  storage.root = mkdtempSync(path.join(tmpdir(), 'sim-media-lineage-'))
+  await seedKnowledgeAclFixture(ids)
+  known = {
+    status: 'exact',
+    entries: [
+      {
+        name: 'MEDIA_TOKEN',
+        encryptedValue: (await encryptSecret(SECRET)).encrypted,
+        sourceUserId: ids.aliceId,
+        sourceWorkspaceId: ids.workspaceId,
+      },
+    ],
+  }
+  const record = audit.recordAudit
+  vi.spyOn(audit, 'recordAudit').mockImplementation((entry) => {
+    if (entry.workspaceId === ids.workspaceId) submittedAudits += 1
+    record(entry)
+  })
+  const batch = audit.recordAuditBatch
+  vi.spyOn(audit, 'recordAuditBatch').mockImplementation((entries) => {
+    submittedAudits += entries.filter((entry) => entry.workspaceId === ids.workspaceId).length
+    batch(entries)
+  })
+})
+
+afterAll(async () => {
+  await drainAudits()
+  vi.restoreAllMocks()
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  await rm(storage.root, { recursive: true, force: true })
+})
+
+describe('media input version lineage', () => {
+  it.each(['known', 'unknown'] as const)(
+    'does not expose storage failures for %s input bytes before a read result exists',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(SECRET),
+        `${SECRET}-${classification}.bin`,
+        'application/octet-stream',
+        {
+          secretProvenance: classification === 'known' ? known : { status: 'unknown' },
+          notifyWorkspaceChange: false,
+        }
+      )
+      await rm(path.join(storage.root, file.key))
+      await expect(fetchWorkspaceFileBuffer(file, { maxBytes: 1024 })).rejects.toThrow(SECRET)
+      const result = await ffmpegServerTool.execute(
+        { operation: 'convert', inputs: { files: [{ path: file.id }] } },
+        {
+          userId: ids.aliceId,
+          workspaceId: ids.workspaceId,
+          toolCallId: generateId(),
+          copilotToolExecution: true,
+          resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+          }),
+        }
+      )
+      expect(result.success).toBe(false)
+      expect(result.message).not.toContain(SECRET)
+      expect(result.message).not.toContain(storage.root)
+      await expect(
+        readWorkspaceFileContent.execute({
+          principal: { kind: 'session', userId: ids.aliceId, sessionId: generateId() },
+          input: { fileId: file.id, includeSecretProvenance: true },
+        })
+      ).rejects.toThrow(SECRET)
+    }
+  )
+
+  it.each(['known', 'unknown'] as const)(
+    'persists the %s evidence of the bytes read after reference resolution',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from('public version one'),
+        `input-${generateId()}.bin`,
+        'application/octet-stream',
+        { secretProvenance: CLEAN, notifyWorkspaceChange: false }
+      )
+      const provenance = classification === 'known' ? known : { status: 'unknown' as const }
+      const execute = readWorkspaceFileContent.execute
+      const pause = vi
+        .spyOn(readWorkspaceFileContent, 'execute')
+        .mockImplementationOnce(async (args) => {
+          await replace(file.id, SECRET, provenance)
+          return execute(args)
+        })
+      try {
+        const result = await ffmpegServerTool.execute(
+          {
+            operation: 'convert',
+            inputs: { files: [{ path: `files/${file.name}` }] },
+            outputs: { files: [{ path: `files/output-${generateId()}.bin` }] },
+          },
+          {
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+            toolCallId: generateId(),
+            copilotToolExecution: true,
+            resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+              userId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+          }
+        )
+        expect(result.success, result.message).toBe(true)
+        if (!result.fileId) throw new Error('No output file was persisted')
+        const output = await getWorkspaceFile(ids.workspaceId, result.fileId)
+        if (!output) throw new Error('Output file cannot be read back')
+        expect((await fetchWorkspaceFileBuffer(output, { maxBytes: output.size })).toString()).toBe(
+          SECRET
+        )
+        expect(
+          await getBoundWorkspaceFileSecretProvenance(ids.workspaceId, {
+            fileId: output.id,
+            key: output.key,
+            context: output.storageContext ?? 'workspace',
+            contentUpdatedAt: output.contentUpdatedAt ?? undefined,
+          })
+        ).toEqual(provenance)
+      } finally {
+        pause.mockRestore()
+      }
+    }
+  )
+
+  it('returns the captured version evidence when a replacement commits during its storage read', async () => {
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from(SECRET),
+      `input-${generateId()}.bin`,
+      'application/octet-stream',
+      { secretProvenance: known, notifyWorkspaceChange: false }
+    )
+    const fetchContent = workspaceReader.fetchWorkspaceFileBuffer
+    const pause = vi
+      .spyOn(workspaceReader, 'fetchWorkspaceFileBuffer')
+      .mockImplementationOnce(async (...args) => {
+        const bytes = await fetchContent(...args)
+        await replace(file.id, 'public replacement', CLEAN)
+        return bytes
+      })
+    try {
+      const result = await readWorkspaceFileContent.execute({
+        principal: { kind: 'session', userId: ids.aliceId, sessionId: generateId() },
+        input: {
+          fileId: file.id,
+          assertedWorkspaceId: ids.workspaceId,
+          includeSecretProvenance: true,
+        },
+      })
+      expect(result.content.toString()).toBe(SECRET)
+      expect(result.file.key).toBe(file.key)
+      expect(result.secretProvenance).toEqual(known)
+    } finally {
+      pause.mockRestore()
+    }
+  })
+})
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
index 06cc2534864..7b8131ccdb9 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
@@ -17,6 +17,7 @@ import {
   workspace,
   workspaceFileSearchRevision,
 } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { generateId } from '@sim/utils/id'
 import { eq, inArray } from 'drizzle-orm'
 import { NextRequest } from 'next/server'
@@ -341,7 +342,7 @@ export async function removeContentFixture(fixture: ContentFixture): Promise<voi
   await db
     .delete(workflowExecutionSnapshots)
     .where(eq(workflowExecutionSnapshots.workflowId, fixture.run.workflowId))
-  await db.delete(workspace).where(eq(workspace.id, ids.workspaceId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
   await db.delete(organization).where(eq(organization.id, ids.organizationId))
   await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
 }
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 30788f93dae..7d0fc2225a1 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -50,6 +50,23 @@ vi.mock('@/lib/mothership/async-runs/repository', async (importOriginal) => ({
   isActiveSandboxResourceOwner: async () => true,
 }))
 
+/** Provider bytes are synthetic; generic-tool execution and its private metadata consumer are real. */
+const toolProvider = vi.hoisted(() => ({ response: undefined as Response | undefined }))
+vi.mock('@/lib/internal/tool-operations/registry.server', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/lib/internal/tool-operations/registry.server')>()
+  return {
+    ...actual,
+    getInternalToolOperationHandler: async (toolId: string) => {
+      if (toolId === 'file_get_content' && toolProvider.response) {
+        const response = toolProvider.response
+        return async () => response
+      }
+      return actual.getInternalToolOperationHandler(toolId)
+    },
+  }
+})
+
 import { db } from '@sim/db'
 import { copilotChats, userTableRowSecretProvenance } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
@@ -58,6 +75,11 @@ import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { getRedisClient } from '@/lib/core/config/redis'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  RESOLVED_SECRET_PROVENANCE_METADATA_V1,
+  serializePrivateToolMetadataResponseEnvelope,
+} from '@/lib/execution/private-tool-metadata'
 import {
   initializeSessionFileProvenance,
   readSessionSecretProvenance,
@@ -244,17 +266,103 @@ describe('content reaching Chat is admitted per item', () => {
     else expect(read.body).not.toContain(CANARY.secret)
   }
 
+  describe('generic tool route and private provider envelopes', () => {
+    async function providerResponse(options: { complete: boolean; success: boolean }) {
+      const envelope = serializePrivateToolMetadataResponseEnvelope(
+        options.success
+          ? { success: true, data: { content: `provider content ${CANARY.secret}` } }
+          : { success: false, error: `provider refused ${CANARY.secret}` },
+        RESOLVED_SECRET_PROVENANCE_METADATA_V1,
+        {
+          version: 1,
+          complete: options.complete,
+          scope: { userId: fixture.ids.aliceId, workspaceId: ws() },
+          entries: options.complete
+            ? [
+                {
+                  name: 'PROVIDER_TOKEN',
+                  encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+                },
+              ]
+            : [],
+        }
+      )
+      toolProvider.response = Response.json(envelope.body, {
+        status: options.success ? 200 : 400,
+        headers: envelope.headers,
+      })
+    }
+
+    it.each([true, false])(
+      'projects private provider evidence through the CLI tool route (success=%s)',
+      async (success) => {
+        await providerResponse({ complete: true, success })
+        try {
+          const read = await cli('POST', '/api/v2/tools/file_get_content/execute', {
+            workspaceId: ws(),
+            input: { fileId: fixture.files.entries },
+          })
+          expect(read.status).toBe(200)
+          expect(JSON.parse(read.body).data.status).toBe(success ? 'succeeded' : 'failed')
+          expect(modelView(read)).toContain('{{PROVIDER_TOKEN}}')
+          expect(modelView(read)).not.toContain(CANARY.secret)
+          expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+        } finally {
+          toolProvider.response = undefined
+        }
+      }
+    )
+
+    it('withholds an incomplete private provider envelope after the generic tool settles', async () => {
+      await providerResponse({ complete: false, success: true })
+      try {
+        const read = await cli('POST', '/api/v2/tools/file_get_content/execute', {
+          workspaceId: ws(),
+          input: { fileId: fixture.files.unknown },
+        })
+        expect(read.status).not.toBe(200)
+        expect(read.body).not.toContain(CANARY.secret)
+        expect(read.body).toMatch(/settled|completed/)
+        expect(read.body).toMatch(/do not retry/i)
+        expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+      } finally {
+        toolProvider.response = undefined
+      }
+    })
+
+    it('records private provider evidence before sandbox tool response bytes are released', async () => {
+      await providerResponse({ complete: true, success: true })
+      try {
+        const read = await sandbox('POST', '/api/v2/tools/file_get_content/execute', {
+          workspaceId: ws(),
+          input: { fileId: fixture.files.entries },
+        })
+        expect(read.status).toBe(200)
+        expect(read.body).toContain(CANARY.secret)
+        expect(await workbenchHistory(read.sessionKey)).toMatchObject({
+          status: 'exact',
+          entries: [{ name: 'PROVIDER_TOKEN' }],
+        })
+      } finally {
+        toolProvider.response = undefined
+      }
+    })
+  })
+
   describe('Chat CLI', () => {
-    it('zips only admitted files into a bulk download (P1/P2, #4)', async () => {
+    it('reports omitted files in a partial bulk download (P1/P2, #4)', async () => {
       const read = await cli(
         'GET',
         `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${Object.values(fixture.files)}`
       )
       expectPerItem(read, { secretAdmitted: false })
       expect(read.body).toContain(CANARY.unrecorded)
+      expect(read.body).toContain('sim-download-report.json')
+      expect(read.body).toContain(fixture.files.unknown)
+      expect(read.body).toContain(fixture.files.entries)
     })
 
-    it('answers files search, dropping lines from refused files (#5, misroute)', async () => {
+    it('answers files search with locations and withheld unreadable previews (#5, misroute)', async () => {
       const read = await cli(
         'GET',
         `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
@@ -264,7 +372,10 @@ describe('content reaching Chat is admitted per item', () => {
       const files = new Set(results.map((result) => result.fileId))
       expect(files.has(fixture.files.clean)).toBe(true)
       expect(files.has(fixture.files.unrecorded)).toBe(true)
-      expect(files.has(fixture.files.unknown)).toBe(false)
+      expect(files.has(fixture.files.unknown)).toBe(true)
+      expect(results.find((result) => result.fileId === fixture.files.unknown)?.text).toMatch(
+        /preview withheld/i
+      )
       expect(read.body).not.toContain(CANARY.unknown)
       expect(read.registry.isPermanentlyIncomplete()).toBe(false)
     })
@@ -316,9 +427,10 @@ describe('content reaching Chat is admitted per item', () => {
       expectPerItem(read, { secretAdmitted: true })
     })
 
-    it('does not admit Chat to a whole knowledge base export (#12)', async () => {
+    it('exports the allowed knowledge scope without including restricted documents (#12)', async () => {
       const read = await cli('GET', `${kbPath()}/export?workspaceId=${ws()}`)
-      expect(read.status).toBe(403)
+      expect(read.status).toBe(200)
+      expect(read.body).toContain('manifest.json')
       expect(read.body).not.toContain(CANARY.unknown)
     })
 
@@ -330,29 +442,63 @@ describe('content reaching Chat is admitted per item', () => {
       expectPerItem(read, { secretAdmitted: true })
     })
 
-    it('refuses predicates over a table whose cells it cannot vouch for (#18b)', async () => {
+    it('filters and sorts mixed-provenance rows without refusing unrelated content (#18b)', async () => {
       const table = `/api/v2/tables/${fixture.table.tableId}`
-      const guess = { field: 'note', op: 'contains', value: 'second' }
-      const refused = [
-        await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' }),
-        await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess, limit: 1 }),
-        await cli('POST', `${table}/query/count`, { workspaceId: ws(), predicate: guess }),
-      ]
-      for (const read of refused) {
-        expect(read.status).toBe(403)
-        expect(read.body).not.toContain(CANARY.unknown)
-        expect(read.body).not.toContain(CANARY.secret)
-      }
-      /** The same predicate reads nothing but row ids, so it stays available. */
-      const byId = await cli('POST', `${table}/query`, {
+      const predicate = { field: 'note', op: 'contains', value: 'second' }
+      const query = await cli('POST', `${table}/query`, {
         workspaceId: ws(),
-        predicate: { field: 'id', op: 'in', value: [fixture.table.rows.clean] },
+        predicate,
+        sort: [{ field: 'note', direction: 'asc' }],
       })
-      expect(byId.status).toBe(200)
-      expect(modelView(byId)).toContain(CANARY.clean)
+      expectPerItem(query, { secretAdmitted: true })
+      const count = await cli('POST', `${table}/query/count`, { workspaceId: ws(), predicate })
+      expect(count.status).toBe(200)
+      expect(count.body).not.toContain(CANARY.secret)
+      expect(count.body).not.toContain(CANARY.unknown)
     })
 
-    it('runs predicates over a table whose every cell is vouched for', async () => {
+    it('returns search locations without copying cell values or refusing a mixed table', async () => {
+      const search = await cli('POST', `/api/v2/tables/${fixture.table.tableId}/rows/search`, {
+        workspaceId: ws(),
+        q: 'second',
+      })
+      expect(search.status).toBe(200)
+      const matches: { rowId: string; column: string; ordinal: number }[] = JSON.parse(search.body)
+        .data.matches
+      expect(matches.map((match) => match.rowId).sort()).toEqual(
+        Object.values(fixture.table.rows).sort()
+      )
+      expect(search.body).not.toContain(CANARY.secret)
+      expect(search.body).not.toContain(CANARY.unknown)
+    })
+
+    it.each(['PATCH', 'DELETE'])(
+      'allows a filtered %s beside an unrelated unknown row',
+      async (method) => {
+        const table = `/api/v2/tables/${fixture.table.tableId}`
+        const marker = `temporary-${generateId()}`
+        const created = await cli('POST', `${table}/rows`, {
+          workspaceId: ws(),
+          data: { note: marker },
+        })
+        expect(created.status).toBe(201)
+        const rowId: string = JSON.parse(created.body).data.id
+        const written = await cli(method, `${table}/rows`, {
+          workspaceId: ws(),
+          filter: { field: 'note', op: 'eq', value: marker },
+          ...(method === 'PATCH' ? { data: { note: `${marker}-updated` } } : {}),
+        })
+        expect(written.status).toBe(200)
+        expect(JSON.parse(written.body).data).toMatchObject(
+          method === 'PATCH' ? { updatedCount: 1 } : { deletedCount: 1 }
+        )
+        const read = await cli('GET', `${table}/rows/${rowId}?workspaceId=${ws()}`)
+        expect(read.status).toBe(method === 'PATCH' ? 200 : 404)
+        if (method === 'PATCH') expect(modelView(read)).toContain(`${marker}-updated`)
+      }
+    )
+
+    it('keeps clean matches usable when another row has corrupt provenance', async () => {
       const created = await cli('POST', '/api/v2/tables', {
         workspaceId: ws(),
         name: `clean_${generateId().slice(0, 8)}`,
@@ -391,7 +537,14 @@ describe('content reaching Chat is admitted per item', () => {
         workspaceId: ws(),
         predicate: guess,
       })
-      expect(afterCorruption.status).toBe(403)
+      expect(afterCorruption.status).toBe(200)
+      expect(modelView(afterCorruption)).toContain('alpha second')
+      const refused = await cli(
+        'GET',
+        `${table}/rows/${JSON.parse(malformed.body).data.id}?workspaceId=${ws()}`
+      )
+      expect(refused.status).toBe(403)
+      expect(refused.body).not.toContain('gamma')
     })
 
     it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {
@@ -644,13 +797,17 @@ describe('content reaching Chat is admitted per item', () => {
       expect(zip.status).toBe(200)
       expect(zip.body).toContain(CANARY.clean)
       expect(zip.body).not.toContain(CANARY.unknown)
+      expect(zip.body).toContain('sim-download-report.json')
+      expect(zip.body).toContain(fixture.files.unknown)
 
       const search = await sandbox(
         'GET',
         `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
       )
       expect(search.status).toBe(200)
-      expect(search.body).not.toContain(fixture.files.unknown)
+      expect(search.body).toContain(fixture.files.unknown)
+      expect(search.body).toMatch(/preview withheld/i)
+      expect(search.body).not.toContain(CANARY.unknown)
       expect((await workbenchHistory(search.sessionKey)).status).toBe('exact')
     })
 
@@ -680,7 +837,8 @@ describe('content reaching Chat is admitted per item', () => {
       }
       expect(write.status).toBe(502)
       expect(write.body).not.toContain(note)
-      expect(write.body).toContain('Do not retry a mutation automatically')
+      expect(write.body).toContain('The change was saved')
+      expect(write.body).toContain('Do not retry the change')
       const rows = await cli(
         'GET',
         `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
diff --git a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
index da012151319..1dec04fd81d 100644
--- a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
@@ -28,6 +28,7 @@ import { db } from '@sim/db'
 import {
   auditLog,
   copilotAsyncToolCalls,
+  copilotAsyncToolCallsPersistSeq,
   copilotChats,
   copilotMessages,
   copilotRequestStops,
@@ -82,6 +83,7 @@ import {
   v2ExecuteWorkflowDataSchema,
   v2WorkflowRunStatusSchema,
 } from '@/lib/api/contracts/v2/workflows'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { env } from '@/lib/core/config/env'
 import { clearLargeValueCacheForTests } from '@/lib/execution/payloads/cache'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
@@ -127,6 +129,7 @@ import {
   resolveActiveResourceContext,
 } from '@/lib/mothership/chat/process-contents'
 import { finalizeAssistantTurn } from '@/lib/mothership/chat/terminal-state'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { prepareInboxAttachments } from '@/lib/mothership/inbox/attachments'
 import { claimRunController } from '@/lib/mothership/request/lifecycle/controller-ownership'
 import { runCopilotLifecycle } from '@/lib/mothership/request/lifecycle/run'
@@ -1171,6 +1174,10 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
     beforeAll(async () => {
       fixture.directory = await mkdtemp(join(tmpdir(), 'mship-run-logs-'))
       await db.execute(sql`CREATE SCHEMA ${sql.identifier(schemaName)}`)
+      const persistSequenceName = copilotAsyncToolCallsPersistSeq.seqName
+      if (!persistSequenceName) throw new Error('Tool-call persistence sequence has no name')
+      const persistSequence = sql`${sql.identifier(schemaName)}.${sql.identifier(persistSequenceName)}`
+      await db.execute(sql`CREATE SEQUENCE ${persistSequence}`)
       for (const table of tables) {
         const config = getTableConfig(table)
         const columns = config.columns.map((column) => {
@@ -1185,6 +1192,9 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
           sql`CREATE TABLE ${sql.identifier(config.name)} (${sql.join(columns, sql`, `)})`
         )
       }
+      await db.execute(
+        sql`ALTER SEQUENCE ${persistSequence} OWNED BY ${sql.identifier(schemaName)}.${sql.identifier(getTableConfig(copilotAsyncToolCalls).name)}.${sql.identifier(copilotAsyncToolCalls.persistSeq.name)}`
+      )
       await db.execute(
         sql`ALTER TABLE workflow_execution_snapshots ALTER COLUMN created_at SET DEFAULT now()`
       )
@@ -1287,7 +1297,7 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
       await Promise.all(postExecution.mock.calls.map(([promise]) => promise))
     })
     afterAll(async () => {
-      postExecution.mockRestore()
+      postExecution?.mockRestore()
       controlServer?.closeAllConnections()
       if (controlServer) await new Promise<void>((resolve) => controlServer.close(() => resolve()))
       try {
@@ -2644,6 +2654,15 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
       async (extension) => {
         const name = `shared-${generateId()}.${extension}`
         const chats = [generateId(), generateId()]
+        const emptyChatId = generateId()
+        await db.insert(copilotChats).values(
+          [...chats, emptyChatId].map((id) => ({
+            id,
+            workspaceId,
+            userId: 'run-reader',
+            type: 'mothership' as const,
+          }))
+        )
         const attachmentIds = [generateId(), generateId()]
         const fileIds: string[] = []
         try {
@@ -2679,34 +2698,43 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               .where(eq(workspaceFiles.key, prepared.storedAttachments[0].key))
             fileIds.push(row.id)
           }
-          const read = async (chatId: string) =>
-            executeAgentCliRequest(
-              {
-                invocation:
-                  extension === 'pdf'
-                    ? {
-                        kind: 'augmentation',
-                        name: 'files view',
-                        positionals: [`uploads/${encodeURIComponent(name)}`],
-                        flags: {},
-                      }
-                    : {
-                        kind: 'cli',
-                        argv: ['files', 'read', `uploads/${encodeURIComponent(name)}`],
-                      },
-              },
-              {
-                workspaceId,
-                userId: 'run-reader',
-                chatId,
-                resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
-                  userId: 'run-reader',
-                  workspaceId,
-                }),
-              }
+          const read = async (chatId: string) => {
+            const registry = new ResolvedSecretTraceRegistry([], {
+              userId: 'run-reader',
+              workspaceId,
+            })
+            return observeContentDelivery(
+              createRegistryContentGate({ registry, actorUserId: 'run-reader', workspaceId }),
+              () =>
+                executeAgentCliRequest(
+                  {
+                    invocation:
+                      extension === 'pdf'
+                        ? {
+                            kind: 'augmentation',
+                            name: 'files view',
+                            positionals: [`uploads/${encodeURIComponent(name)}`],
+                            flags: {},
+                          }
+                        : {
+                            kind: 'cli',
+                            argv: ['files', 'read', `uploads/${encodeURIComponent(name)}`],
+                          },
+                  },
+                  {
+                    workspaceId,
+                    userId: 'run-reader',
+                    chatId,
+                    resolvedSecretTraceRegistry: registry,
+                  }
+                )
             )
+          }
           const first = await read(chats[0])
-          expect(first.exitCode, first.stderr).toBe(0)
+          expect(
+            first.exitCode,
+            JSON.stringify({ stderr: first.stderr, errors: fixture.errors })
+          ).toBe(0)
           const second = await read(chats[1])
           expect(second.exitCode, second.stderr).toBe(0)
           if (extension === 'csv') {
@@ -2724,7 +2752,7 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               )
             }
           }
-          const absent = await read(generateId())
+          const absent = await read(emptyChatId)
           expect(absent.exitCode).not.toBe(0)
           expect(absent.stdout).not.toContain('second')
           expect(absent.observations).toBeUndefined()
@@ -2744,13 +2772,19 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               { workspaceId, reference }
             )
             expect(mediaReference.id).toBe(fileIds[index])
-            const mounts = await resolveInputFiles(
-              context,
-              [{ path: reference, sandboxPath: '/tmp/incoming.csv' }],
-              undefined,
-              undefined,
-              new ResolvedSecretTraceRegistry([], { userId: 'run-reader', workspaceId })
+            const { files: mounts, excluded } = await observeContentDelivery(
+              createRegistryContentGate({
+                registry: new ResolvedSecretTraceRegistry([], {
+                  userId: 'run-reader',
+                  workspaceId,
+                }),
+                actorUserId: 'run-reader',
+                workspaceId,
+              }),
+              () =>
+                resolveInputFiles(context, [{ path: reference, sandboxPath: '/tmp/incoming.csv' }])
             )
+            expect(excluded).toEqual([])
             expect(mounts).toHaveLength(1)
             const mount = mounts[0]
             if (mount.type === 'url') throw new Error('Expected inline mount bytes')
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 3e18bf60368..8094b1ce2d2 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -1,3 +1,4 @@
+import type { Principal } from '@sim/auth/principal'
 import { dbChainMockFns, workflowAuthzMockFns } from '@sim/testing'
 import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import {
@@ -81,11 +82,15 @@ const {
   readWorkspaceFileMetadata: vi.fn(),
   readTableView: vi.fn(),
   readWorkflowMetadata: vi.fn(),
-  listWorkflowFolders: vi.fn(
-    async (): Promise<{ folders: { id: string; name: string; parentId: string | null }[] }> => ({
-      folders: [],
-    })
-  ),
+  listWorkflowFolders: vi.fn<
+    (
+      request: Parameters<
+        typeof import('@/lib/workflows/application/workflow-folders').listWorkflowFolders.execute
+      >[0]
+    ) => Promise<{ folders: { id: string; name: string; parentId: string | null }[] }>
+  >(async () => ({
+    folders: [],
+  })),
   listTableFolders: vi.fn(
     async (): Promise<{ folders: { id: string; name: string; parentId: string | null }[] }> => ({
       folders: [],
@@ -476,8 +481,8 @@ describe('processContextsServer - docs contexts', () => {
     const result = await processContextsServer(
       [
         { kind: 'docs', label: 'Product docs' },
-        { kind: 'blocks', label: 'Read [rows]' },
-        { kind: 'integration', label: 'My service' },
+        { kind: 'blocks', blockIds: [], label: 'Read [rows]' },
+        { kind: 'integration', blockType: 'custom_api', label: 'My service' },
       ],
       'reader',
       '@Product docs compare @Read [rows] with @My service and @unknown',
@@ -1402,7 +1407,15 @@ describe('processContextsServer - table_selection contexts', () => {
       nextCursor: 'next-page',
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1422,7 +1435,15 @@ describe('processContextsServer - table_selection contexts', () => {
       nextCursor: null,
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1445,7 +1466,15 @@ describe('processContextsServer - table_selection contexts', () => {
       totalCount: 2,
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2', 'r1'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2', 'r1'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1461,6 +1490,7 @@ describe('processContextsServer - table_selection contexts', () => {
         {
           kind: 'table_selection',
           tableId: 'tbl-1',
+          tableName: 'Sales',
           label: 'Rows',
           rowIds: Array.from({ length: MAX_TABLE_SELECTION_ROWS + 1 }, (_, i) => `r${i}`),
         },
@@ -1504,7 +1534,15 @@ describe('processContextsServer - table_selection contexts', () => {
       return { rows, totalCount: 1 }
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Keys', rowIds: ['r1'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Keys',
+          label: 'Keys',
+          rowIds: ['r1'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1530,7 +1568,15 @@ describe('processContextsServer - table_selection contexts', () => {
     })
     queryTableRows.mockResolvedValue({ rows: [{ id: 'r1', data: {} }], totalCount: 1 })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -2075,15 +2121,16 @@ describe('organization resource mention targets', () => {
    * yields no context.
    */
   const ownedBy =
-    (workspaceId: string, value: unknown) =>
+    <T>(workspaceId: string, value: T) =>
     async ({
       principal,
       input,
     }: {
-      principal: { workspaceId?: string }
+      principal: Principal
       input: { workspaceId?: string; assertedWorkspaceId?: string }
     }) => {
       if (
+        !('workspaceId' in principal) ||
         principal.workspaceId !== workspaceId ||
         (input.workspaceId ?? input.assertedWorkspaceId) !== workspaceId
       ) {
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
index 6ec738a212c..62fc68de9bd 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -17,6 +17,7 @@ import {
   observeContentDelivery,
   redactBeforeCutting,
 } from '@/lib/core/application/content-delivery'
+import { PROVENANCE_MAX_ENTRIES } from '@/lib/execution/provenance-limits'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { sliceFileTextLines } from '@/lib/workspace-files/text-lines'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
@@ -104,6 +105,7 @@ describe('createRegistryContentGate', () => {
     expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
     /** The other secret is not in what this result shows, so it is not activated by it. */
     expect(modelView(`other=${OTHER_SECRET}`, registry)).toContain(OTHER_SECRET)
+    expect(encryptionMockFns.mockDecryptSecret).toHaveBeenCalledTimes(2)
   })
 
   it('activates nothing for a derived view that shows nothing', async () => {
@@ -170,6 +172,46 @@ describe('createRegistryContentGate', () => {
     expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
   })
 
+  it('refuses an item that exceeds the remaining capacity without withholding earlier content', async () => {
+    const registry = newRegistry()
+    const values = Array.from(
+      { length: PROVENANCE_MAX_ENTRIES - 1 },
+      (_, index) => `SYNTHETIC_EXISTING_SECRET_${index}`
+    )
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('existing', exact(...values))])).toEqual([true])
+
+    expect(await gate.admit([item('overflow', exact(SECRET, OTHER_SECRET))])).toEqual([false])
+
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`public notes token=${values[0]}`, registry)).toBe(
+      'public notes token={{FIXTURE_TOKEN}}'
+    )
+    expect(modelView(`new token=${SECRET}`, registry)).toContain(SECRET)
+  })
+
+  it('admits only the concurrent item that fits without tainting the shared registry', async () => {
+    const registry = newRegistry()
+    const values = Array.from(
+      { length: PROVENANCE_MAX_ENTRIES - 1 },
+      (_, index) => `SYNTHETIC_EXISTING_SECRET_${index}`
+    )
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('existing', exact(...values))])).toEqual([true])
+
+    const verdicts = await Promise.all([
+      gate.admit([item('first', exact(SECRET))]),
+      gate.admit([item('second', exact(OTHER_SECRET))]),
+    ])
+
+    expect(verdicts.flat().sort()).toEqual([false, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`public notes token=${values[0]}`, registry)).toBe(
+      'public notes token={{FIXTURE_TOKEN}}'
+    )
+    expect(registry.exportProvenance().entries).toHaveLength(PROVENANCE_MAX_ENTRIES)
+  })
+
   it('redacts a multi-line secret before a line window could cut one line out of it', async () => {
     const key = ['-----BEGIN FIXTURE KEY-----', 'FIXTURELINEONE0123', 'FIXTURELINETWO4567'].join(
       '\n'
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index ccbe3c9d1ad..ba9da0ae097 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -10,7 +10,7 @@ import {
   reportContentRefusal,
 } from '@/lib/mothership/content-delivery/telemetry'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface RegistryContentGateScope {
   /** The registry whose projection is the output Chat's model receives. */
@@ -27,8 +27,8 @@ export interface RegistryContentGateScope {
 
 /**
  * Decides items against a model registry: an item's exact secrets are imported so egress redacts
- * them. Each item is first imported into a throwaway registry, so an item whose secrets cannot be
- * imported is refused on its own instead of latching the registry for every other item.
+ * them. Atomic admission checks decryption and the registry's remaining capacity before activating
+ * any entry, so a refused item cannot latch the registry for every other item.
  */
 export function createRegistryContentGate(scope: RegistryContentGateScope): ContentDeliveryGate {
   const refuse = (source: ContentSource, reason: ContentRefusalReason): false =>
@@ -62,16 +62,9 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
     /** A derived view that shows nothing needs no entry; `undefined` would mean the whole item. */
     if (typeof source.view === 'object' && source.view.derived === undefined) return true
     const value = typeof source.view === 'object' ? source.view.derived : undefined
-    const staged = new ResolvedSecretTraceRegistry([], undefined, { staged: true })
-    if (!(await importDurableSecretProvenance(staged, provenance, value))) {
+    if (!(await importDurableSecretProvenance(registry, provenance, value, { atomic: true }))) {
       return refuse(source, 'import')
     }
-    /**
-     * The staged import proved every entry decrypts, so this one only activates them. Its result
-     * also reflects whether the registry was already incomplete for another reason; that output is
-     * withheld anyway, so this item is not refused for it.
-     */
-    await importDurableSecretProvenance(registry, provenance, value)
     return true
   }
 
diff --git a/apps/sim/lib/mothership/content-delivery/telemetry.ts b/apps/sim/lib/mothership/content-delivery/telemetry.ts
index fce1cf6a334..cb2d45cad79 100644
--- a/apps/sim/lib/mothership/content-delivery/telemetry.ts
+++ b/apps/sim/lib/mothership/content-delivery/telemetry.ts
@@ -13,6 +13,7 @@ export const CONTENT_SURFACE: Record<ContentSourceKind, DurableSecretProvenanceS
   'knowledge-document': 'knowledge',
   'knowledge-chunk': 'knowledge',
   'table-row': 'table-row',
+  'tool-result': 'tool-result',
 }
 
 const FILE_CAUSES: Record<ContentRefusalReason, DurableSecretProvenanceRefusalCause> = {
@@ -40,6 +41,12 @@ const CAUSES: Record<
     registry: 'content-registry-unavailable',
     import: 'knowledge-result-provenance-unavailable',
   },
+  'tool-result': {
+    unknown: 'tool-result-provenance-unavailable',
+    opaque: 'tool-result-provenance-unavailable',
+    registry: 'content-registry-unavailable',
+    import: 'tool-result-provenance-unavailable',
+  },
   'table-row': {
     unknown: 'table-row-provenance-unavailable',
     opaque: 'table-row-opaque-secret-content',
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
index f45da265bb1..d3a5d713e5a 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
@@ -229,7 +229,7 @@ describe('Mothership file mounts bind content and classification to the same rec
    * The run's code can read every mounted byte, so the per-call registry the Copilot projection
    * and output-file writers read must carry the mount's own verdict across the crossing: exact
    * mounts keep redacting and clean mounts stay readable, while an unknown file never enters the
-   * runtime and the output names it as left out.
+   * runtime and the requested code never runs with incomplete inputs.
    */
   it.each(['safe', 'secret', 'unknown'] as const)(
     'carries a %s mount verdict across the run_code crossing',
@@ -253,9 +253,11 @@ describe('Mothership file mounts bind content and classification to the same rec
       )
 
       if (kind === 'unknown') {
-        expect(toolsMockFns.mockExecuteTool.mock.calls[0]?.[1]?._sandboxFiles).toBeUndefined()
+        expect(toolsMockFns.mockExecuteTool).not.toHaveBeenCalled()
+        expect(result.success).toBe(false)
         expect(mocks.buffer).not.toHaveBeenCalled()
         expect(result.output).toMatchObject({
+          codeExecuted: false,
           excludedInputs: [{ path: '/tmp/source.txt', reason: expect.any(String) }],
         })
         return
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
index 5aa726d90da..e5be1e94a53 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
@@ -201,22 +201,18 @@ describe('Mothership table mounts through code calls', () => {
     expect(mocks.execute).not.toHaveBeenCalled()
   })
 
-  /**
-   * A snapshot whose rows hold a recorded secret, or lack vouched provenance, is opaque to
-   * redaction once mounted, so it is left out on its own and reported; the run itself proceeds.
-   */
-  it('excludes a table whose snapshot is unsafe for Chat, before any byte or URL is acquired', async () => {
+  it('stops before code execution when a requested table snapshot is refused', async () => {
     mocks.safety.mockResolvedValueOnce('stale')
     await expect(run('table-orders')).rejects.toThrow('changed while preparing')
     expect(mocks.presign).not.toHaveBeenCalled()
     mocks.cloud.mockReturnValue(true)
     mocks.safety.mockResolvedValue('unsafe-provenance')
     const result = await run('table-orders')
-    const params = mocks.execute.mock.calls[0][1]
-    expect(params._sandboxFiles).toBeUndefined()
+    expect(mocks.execute).not.toHaveBeenCalled()
     expect(mocks.presign).not.toHaveBeenCalled()
     expect(mocks.download).not.toHaveBeenCalled()
     expect(result.output).toMatchObject({
+      codeExecuted: false,
       excludedInputs: [{ path: 'table-orders', reason: expect.any(String) }],
     })
   })
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute.ts b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
index 6b2fe88d1e4..726ba9d292e 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
@@ -88,12 +88,12 @@ export interface ExcludedInput {
 }
 
 const UNVERIFIED_INPUT_REASON =
-  'Its secret provenance could not be verified, so it was not mounted. Other inputs were mounted.'
+  'Its secret provenance could not be verified, so code was not executed.'
 
 /**
  * Mounts one file whose classification the installed gate admits. A file the gate refuses is left
- * out on its own and reported, so one unknown file neither withholds the run's output nor enters
- * the workbench's history, where it would withhold every later run in the chat.
+ * out and reported. The caller stops before executing code if any requested mount is refused;
+ * refused bytes never enter workbench history or disable later calls without those inputs.
  */
 async function pushWorkspaceFileMount(
   mounts: ResolvedInputMounts,
@@ -568,7 +568,6 @@ export async function executeFunctionExecute(
       : undefined
   let mountedRegistry: ResolvedSecretTraceRegistry | undefined
   let crossingValue: unknown
-  let excludedInputs: ExcludedInput[] = []
 
   /**
    * Hoisted so the usage trail in `finally` attributes the run to the same identity the mount
@@ -650,7 +649,14 @@ export async function executeFunctionExecute(
           }),
           () => resolveInputFiles(context, inputFiles, inputTables, inputDirectories)
         )
-        excludedInputs = resolved.excluded
+        if (resolved.excluded.length > 0) {
+          return {
+            success: false,
+            error:
+              'One or more requested inputs could not be mounted safely. Code was not executed.',
+            output: { codeExecuted: false, excludedInputs: resolved.excluded },
+          }
+        }
         if (resolved.files.length > 0) {
           const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
           enrichedParams._sandboxFiles = [...existing, ...resolved.files]
@@ -726,9 +732,7 @@ export async function executeFunctionExecute(
       const cost = toRecord(toRecord(result.output)?.cost)
       if (typeof cost?.raw === 'number') await recordServiceCost('sandbox', cost.raw)
       crossingValue = result
-      return excludedInputs.length > 0
-        ? { ...result, output: { ...toRecord(result.output), excludedInputs } }
-        : result
+      return result
     } catch (error) {
       crossingValue = error
       throw error
diff --git a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
index 3b86ca5d185..64f5fccc1de 100644
--- a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
@@ -63,7 +63,12 @@ vi.mock('@/lib/mothership/vfs/resource-writer', () => ({
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import * as inProcessTransport from '@/lib/api/server/routes/in-process-transport'
-import { admitContent, type ContentProvenance } from '@/lib/core/application/content-delivery'
+import {
+  admitContent,
+  admitWrittenContent,
+  type ContentProvenance,
+  runDeclaredContentOperation,
+} from '@/lib/core/application/content-delivery'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
@@ -92,6 +97,7 @@ import {
 } from '@/lib/mothership/tools/sandbox-resources'
 import { buildMothershipSandboxSession } from '@/lib/mothership/tools/sandbox-session'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { tableOperations } from '@/lib/table/application/operations'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { buildFunctionExecuteBody, functionExecuteTool } from '@/tools/function/execute'
@@ -620,10 +626,13 @@ describe('sandbox API provenance admission', () => {
 
   it('preserves mutation completion and withholds its body when provenance storage fails', async () => {
     const mutationPath = join(root, 'mutation.json')
+    const principal = createDelegatedPrincipal({
+      subjectUserId: scope.userId,
+      workspaceId: scope.workspaceId,
+    })
     const response = await sandboxApi(
       '/api/v2/tables/fixture/rows',
       async () => {
-        await writeFile(mutationPath, JSON.stringify({ committed: true, completed: false }))
         const evalCommand = redis.eval.bind(redis)
         vi.spyOn(redis, 'eval').mockImplementation((...args) => {
           if (String(args[2]).startsWith('mothership:workbench-provenance:v2:')) {
@@ -631,13 +640,24 @@ describe('sandbox API provenance admission', () => {
           }
           return evalCommand(...args)
         })
-        /** A committed write's gate failure is deferred past its effects, as the use case does. */
-        let failure: unknown
-        await deliver('table', TOKEN_PROVENANCE(), canary).catch((error: unknown) => {
-          failure = error
-        })
-        await writeFile(mutationPath, JSON.stringify({ committed: true, completed: true }))
-        if (failure) throw failure
+        await runDeclaredContentOperation(
+          tableOperations.createRows,
+          principal,
+          async () => {
+            await writeFile(mutationPath, JSON.stringify({ committed: true, completed: false }))
+            await admitWrittenContent(principal, [
+              {
+                kind: 'table-row',
+                id: 'fixture',
+                provenance: TOKEN_PROVENANCE(),
+                view: { derived: canary },
+              },
+            ])
+          },
+          async () => {
+            await writeFile(mutationPath, JSON.stringify({ committed: true, completed: true }))
+          }
+        )
         return Response.json({ data: { value: canary } }, { status: 201 })
       },
       'POST'
@@ -649,8 +669,8 @@ describe('sandbox API provenance admission', () => {
     expect(response.status).toBe(502)
     const body = await response.text()
     expect(body).not.toContain(canary)
-    expect(body).toContain('completed with HTTP 201')
-    expect(body).toContain('Do not retry a mutation automatically')
+    expect(body).toContain('The change was saved')
+    expect(body).toContain('Do not retry the change')
   })
 
   it.each(['file', 'table'] as const)(
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index 30924d50226..136e0f96efa 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -140,8 +140,9 @@ async function proxyAuthorizedSandboxRequest(
       })
       const withheld = Response.json(
         {
-          error:
-            'The API request ran, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.',
+          error: error.committedWrite
+            ? 'The change was saved, but its result could not be returned safely. Do not retry the change.'
+            : 'The API request ran, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.',
         },
         { status: 502 }
       )
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 40d9ba4f82b..5026178a10c 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -665,23 +665,6 @@ const COMPILABLE_FORMATS: Record<string, CompilableFormat> = {
   '.pdf': { magic: PDF_MAGIC, taskId: 'pdf-generate', contentType: PDF_MIME },
 }
 
-/**
- * The files a Chat compile may read through the isolate's broker: every file its source names
- * literally, each admitted by the caller's gate before the task runs. Other callers are
- * unrestricted, as they have always been.
- */
-async function admitBrokerFiles(
-  args: LegacyCompileArgs
-): Promise<ReadonlyMap<string, ResolvedReferencedImage['record']> | undefined> {
-  const principal = args.filePrincipal
-  if (!principal || !mustClassifyContent(principal)) return undefined
-  const { images } = await resolveReferencedImages(args.source, args.workspaceId, principal)
-  const records = images.map((image) => image.record)
-  const admitted = await admitWorkspaceFiles(principal, args.workspaceId, records, 'complete')
-  if (admitted.length < records.length) throw new ContentRefusedError('workspace-file')
-  return new Map(admitted.map((record) => [record.id, record]))
-}
-
 /** Whether a cached build read exactly the versions this compile admitted, and nothing else. */
 function cachedFromAdmittedVersions(
   contributors: readonly WorkspaceFileSecretProvenanceIdentity[],
@@ -713,14 +696,31 @@ async function compileDocInLegacySandbox(
     )
   }
 
-  /** Admitted before the cache too: a cached build may embed a file the gate now refuses. */
-  const admittedFiles = await admitBrokerFiles(args)
-  const readableWorkspaceFileIds = admittedFiles ? new Set(admittedFiles.keys()) : undefined
   const cacheKey = sha256Hex(`.${fmt.ext}${args.source}${args.workspaceId}`)
   const cached = compiledDocCache.get(cacheKey)
-  /** A build that read another file, or another version of one, is rebuilt for this compile. */
-  const cacheReadable =
-    !admittedFiles || cachedFromAdmittedVersions(cached?.contributingFiles ?? [], admittedFiles)
+  let cacheReadable = true
+  if (cached && args.filePrincipal && mustClassifyContent(args.filePrincipal)) {
+    const { images } = await resolveReferencedImages(
+      args.source,
+      args.workspaceId,
+      args.filePrincipal,
+      new Set(cached.contributingFiles?.map((file) => file.fileId))
+    )
+    const records = images.map((image) => image.record)
+    cacheReadable = cachedFromAdmittedVersions(
+      cached.contributingFiles ?? [],
+      new Map(records.map((file) => [file.id, file]))
+    )
+    if (cacheReadable) {
+      const admitted = await admitWorkspaceFiles(
+        args.filePrincipal,
+        args.workspaceId,
+        records,
+        'complete'
+      )
+      if (admitted.length !== records.length) throw new ContentRefusedError('workspace-file')
+    }
+  }
   if (cached && cacheReadable) {
     return {
       buffer: cached.buffer,
@@ -742,7 +742,7 @@ async function compileDocInLegacySandbox(
     {
       ownerKey: args.ownerKey,
       signal: args.signal,
-      ...(readableWorkspaceFileIds ? { readableWorkspaceFileIds } : {}),
+      filePrincipal: args.filePrincipal,
       onWorkspaceFileAccess: (identity) => {
         contributingFiles.set(`${identity.context}:${identity.fileId}:${identity.key}`, identity)
       },
@@ -760,8 +760,8 @@ async function compileDocInLegacySandbox(
 /**
  * Returns the compiled binary for a document. The remote backend reuses and publishes a
  * dependency-bound artifact after statically staging its inputs. The isolated-VM backend preserves
- * its live-broker semantics and keeps only a small process-local cache; it cannot publish a durable
- * artifact until broker calls can report the exact file versions they accessed.
+ * its live-broker semantics and keeps a small process-local cache bound to the actual file revisions
+ * read by its brokers. Each broker read is authorized and admitted before returning bytes.
  */
 export async function compileDoc(args: CompileArgs): Promise<CompiledDocResult> {
   const { source, fileName, workspaceId } = args
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
index 77c2bea3b06..62c26086625 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
@@ -28,6 +28,8 @@ vi.mock('@/lib/mothership/application/execute-file-use-case', () => ({
   executeCopilotFileUseCase: async () => ({
     file,
     content: await workspaceFileManagerMockFns.mockFetchWorkspaceFileBuffer(file),
+    secretProvenance:
+      await workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance(),
   }),
   resolveCopilotWorkspaceFileReference: (...args: unknown[]) =>
     workspaceFileManagerMockFns.mockResolveWorkspaceFileReference(...args),
@@ -253,22 +255,6 @@ describe('ffmpeg server tool secret provenance', () => {
     })
   })
 
-  it('does not expose storage errors after learning that an input has tracked provenance', async () => {
-    getBoundWorkspaceFileSecretProvenanceMock.mockResolvedValue(TRACKED)
-    fetchWorkspaceFileBufferMock.mockRejectedValue(new Error('storage echoed private bytes'))
-
-    const result = await ffmpegServerTool.execute(
-      { operation: 'convert', inputs: { files: [{ path: 'files/input.mp4' }] } },
-      context
-    )
-
-    expect(result).toEqual({
-      success: false,
-      message: 'ffmpeg convert failed: The media operation failed safely',
-    })
-    expect(runFfmpegOperationMock).not.toHaveBeenCalled()
-  })
-
   it('projects dynamic parser errors before returning them', async () => {
     const secret = 'decoder-secret'
     const errorRegistry = new ResolvedSecretTraceRegistry([
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
index 2c7566a13d9..4818a35ffb3 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { observeContentOutsideModel } from '@/lib/core/application/content-delivery'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { MAX_MEDIA_BYTES } from '@/lib/media/falai'
 import { type FfmpegOperation, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
 import { FFMPEG_LIMITS } from '@/lib/media/ffmpeg-limits'
@@ -17,7 +18,6 @@ import {
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import {
   createWorkspaceFileSecretProvenanceFromRegistry,
-  getBoundWorkspaceFileSecretProvenance,
   mergeWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -134,16 +134,12 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         if (totalInputBytes + fileRecord.size > MAX_MEDIA_BYTES) {
           throw new Error(`Input files exceed the ${MAX_MEDIA_BYTES} byte limit`)
         }
-        const fileProvenance = await getBoundWorkspaceFileSecretProvenance(workspaceId, {
-          fileId: fileRecord.id,
-          key: fileRecord.key,
-          context: fileRecord.storageContext ?? 'workspace',
-          ...(fileRecord.contentUpdatedAt ? { contentUpdatedAt: fileRecord.contentUpdatedAt } : {}),
-        })
-        inputRequiresOpaqueError ||=
-          fileProvenance.status !== 'exact' || fileProvenance.entries.length > 0
         /** The output file carries every input's provenance, merged below; no input reaches a model. */
-        const { content: buffer } = await observeContentOutsideModel(() =>
+        const {
+          file,
+          content: buffer,
+          secretProvenance,
+        } = await observeContentOutsideModel(() =>
           executeCopilotFileUseCase(
             context,
             readWorkspaceFileContent,
@@ -151,10 +147,14 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
               fileId: fileRecord.id,
               assertedWorkspaceId: workspaceId,
               maxBytes: MAX_MEDIA_BYTES,
+              includeSecretProvenance: true,
             },
             { fileId: fileRecord.id }
           )
         )
+        const fileProvenance = secretProvenance ?? { status: 'unknown' as const }
+        inputRequiresOpaqueError ||=
+          fileProvenance.status !== 'exact' || fileProvenance.entries.length > 0
         totalInputBytes += buffer.length
         if (totalInputBytes > MAX_MEDIA_BYTES) {
           throw new Error(`Input files exceed the ${MAX_MEDIA_BYTES} byte limit`)
@@ -162,8 +162,8 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         inputProvenances.push(fileProvenance)
         mediaFiles.push({
           buffer,
-          mimeType: fileRecord.type || 'application/octet-stream',
-          name: fileRecord.name,
+          mimeType: file.type || 'application/octet-stream',
+          name: file.name,
         })
       }
 
@@ -246,7 +246,8 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         downloadUrl: written.downloadUrl,
       }
     } catch (error) {
-      const errorMessage = getErrorMessage(error, '')
+      const errorMessage =
+        asOrchestrationError(error)?.code === 'internal' ? '' : getErrorMessage(error, '')
       const projection = inputRequiresOpaqueError
         ? undefined
         : errorMessage
diff --git a/apps/sim/lib/table/application/operations.ts b/apps/sim/lib/table/application/operations.ts
index 95eb7bae0c9..0b8bf6f2e6e 100644
--- a/apps/sim/lib/table/application/operations.ts
+++ b/apps/sim/lib/table/application/operations.ts
@@ -160,7 +160,7 @@ export const tableOperations = {
     principalKinds: ['session'],
   }),
   queryRows: toolReadOperation('tables.rows.query', 'sourced'),
-  searchRows: readOperation('tables.rows.search', 'sourced'),
+  searchRows: readOperation('tables.rows.search', 'none'),
   readRow: toolReadOperation('tables.rows.read', 'sourced'),
   createRows: toolWriteOperation('tables.rows.create', 'tables.use', 'sourced'),
   replaceRows: writeOperation('tables.rows.replace', 'none'),
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index dfafa9eadad..db8b0d6a462 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -20,25 +20,15 @@ import {
 } from '@sim/testing/mocks/table-rows-service.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { TableDefinition, TablePredicate } from '@/lib/table/types'
+import type { TableDefinition } from '@/lib/table/types'
 
-const {
-  mockIsScopeCompatible,
-  mockLoadExecutionsForRow,
-  mockLoadEnrichmentDetail,
-  mockRowProvenance,
-  mockFindRowMatches,
-  mockClassifyColumns,
-  mockTableHasCellsUnsafe,
-} = vi.hoisted(() => ({
-  mockTableHasCellsUnsafe: vi.fn(),
-  mockFindRowMatches: vi.fn(),
-  mockClassifyColumns: vi.fn(),
-  mockIsScopeCompatible: vi.fn(),
-  mockLoadExecutionsForRow: vi.fn(),
-  mockLoadEnrichmentDetail: vi.fn(),
-  mockRowProvenance: vi.fn(),
-}))
+const { mockLoadExecutionsForRow, mockLoadEnrichmentDetail, mockRowProvenance } = vi.hoisted(
+  () => ({
+    mockLoadExecutionsForRow: vi.fn(),
+    mockLoadEnrichmentDetail: vi.fn(),
+    mockRowProvenance: vi.fn(),
+  })
+)
 
 vi.mock('@sim/audit', () => auditMock)
 
@@ -46,7 +36,6 @@ vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
 vi.mock('@/lib/table', () => ({
   ...tableMock,
-  findRowMatches: mockFindRowMatches,
   TABLE_LIMITS: { ...tableMock.TABLE_LIMITS, MAX_ROW_RUN_STATE_BYTES: 256 },
 }))
 
@@ -59,8 +48,6 @@ vi.mock('@/lib/table/column-types', () => ({
 /** The reader classifies each row on its own; `mockRowProvenance` answers per row id. */
 vi.mock('@/lib/table/rows/secret-provenance', () => ({
   ...tableRowsSecretProvenanceMock,
-  classifyStoredTableRowColumns: mockClassifyColumns,
-  tableHasCellsUnsafeForPredicate: mockTableHasCellsUnsafe,
   TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
     rowProvenance(rowId: string) {
       return mockRowProvenance(rowId)
@@ -72,11 +59,6 @@ vi.mock('@/lib/table/validation', () => ({
   coerceRowValues: vi.fn(),
 }))
 
-vi.mock('@/lib/execution/durable-secret-provenance', () => ({
-  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE: { status: 'exact', entries: [] },
-  isPrivateSecretProvenanceScopeCompatible: mockIsScopeCompatible,
-}))
-
 vi.mock('@/lib/table/rows/service', () => tableRowsServiceMock)
 
 vi.mock('@/lib/table/application/context', () => tableApplicationContextMock)
@@ -109,7 +91,6 @@ import {
   readTableRowEnrichmentDetail,
   replaceProjectedWireRows,
   replaceTableRows,
-  searchTableRows,
   TableRowsValidationError,
   updateTableRow,
   updateTableRows,
@@ -231,7 +212,6 @@ describe('replaceProjectedWireRows application command', () => {
     )
     mockReplaceRowsWithTx.mockResolvedValue({ deletedCount: 2, insertedCount: 1 })
     mockCreateSecretProvenance.mockReturnValue({ complete: true, columns: {} })
-    mockIsScopeCompatible.mockReturnValue(true)
   })
 
   it('validates and replaces against the fresh schema held under the table lock', async () => {
@@ -333,10 +313,6 @@ describe('replaceProjectedWireRows application command', () => {
       { 'column-fresh': 'secret-value' },
       registry
     )
-    expect(mockIsScopeCompatible).toHaveBeenCalledWith(
-      { userId: 'user-1', workspaceId: TABLE.workspaceId },
-      { workspaceId: TABLE.workspaceId }
-    )
     expect(mockReplaceRowsWithTx).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({ secretProvenance: [provenance] }),
@@ -356,7 +332,6 @@ describe('replaceProjectedWireRows application command', () => {
         },
       },
     })
-    mockIsScopeCompatible.mockReturnValue(false)
 
     await replaceProjectedWireRows.execute({
       principal: delegatedPrincipal,
@@ -371,10 +346,6 @@ describe('replaceProjectedWireRows application command', () => {
       },
     })
 
-    expect(mockIsScopeCompatible).toHaveBeenCalledWith(
-      { userId: 'user-1', workspaceId: 'workspace-other' },
-      { workspaceId: TABLE.workspaceId }
-    )
     expect(mockReplaceRowsWithTx).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({ secretProvenance: [{ complete: false, columns: {} }] }),
@@ -680,7 +651,6 @@ describe('row data keying', () => {
     mockResolveContext.mockResolvedValue(contextFor())
     mockAssertRowCapacity.mockResolvedValue(10_000)
     mockCreateSecretProvenance.mockReturnValue({ complete: true, columns: {} })
-    mockIsScopeCompatible.mockReturnValue(true)
   })
 
   it('does not silently drop an id-keyed write, which the name path would', async () => {
@@ -997,89 +967,6 @@ describe('row delivery to Chat', () => {
     }
   )
 
-  describe('predicates Chat runs over cell values', () => {
-    const query = (principal: Caller, predicate?: TablePredicate) =>
-      queryTableRows.execute({
-        principal,
-        input: { tableId: TABLE.id, limit: 25, includeTotal: true, predicate },
-      })
-    const BY_NAME: TablePredicate = { all: [{ field: 'name', op: 'eq', value: 'guess' }] }
-
-    beforeEach(() => {
-      mockQueryRows.mockResolvedValue({ ...PAGE, rowCount: 1, totalCount: 3 })
-      mockTableHasCellsUnsafe.mockResolvedValue(false)
-    })
-
-    it('counts only the rows delivered on the page', async () => {
-      mockRowProvenance.mockReturnValue({ status: 'unknown' })
-      const result = await observeContentDelivery({ admit: gate(false) }, () =>
-        query(CHAT, BY_NAME)
-      )
-      expect(result).toMatchObject({ rows: [], rowCount: 0, totalCount: 3 })
-    })
-
-    it('refuses a predicate over cells it cannot vouch for, before running it', async () => {
-      mockTableHasCellsUnsafe.mockResolvedValue(true)
-      await expect(
-        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
-      ).rejects.toBeInstanceOf(ContentRefusedError)
-      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, new Set(['column-name']))
-      expect(mockQueryRows).not.toHaveBeenCalled()
-    })
-
-    it('refuses when a cell it reads becomes unsafe during the read', async () => {
-      mockTableHasCellsUnsafe.mockResolvedValueOnce(false).mockResolvedValueOnce(true)
-      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      await expect(
-        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
-      ).rejects.toBeInstanceOf(ContentRefusedError)
-    })
-
-    it('checks nothing for an id-only predicate or no predicate, which read no cell', async () => {
-      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      await observeContentDelivery({ admit: gate(true) }, () => query(CHAT))
-      await observeContentDelivery({ admit: gate(true) }, () =>
-        query(CHAT, { all: [{ field: 'id', op: 'in', value: ['row-1'] }] })
-      )
-      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
-    })
-
-    it('refuses a free-text search over a table with any unsafe cell', async () => {
-      mockTableHasCellsUnsafe.mockResolvedValue(true)
-      await expect(
-        observeContentDelivery({ admit: gate(true) }, () =>
-          searchTableRows.execute({ principal: CHAT, input: { tableId: TABLE.id, q: 'guess' } })
-        )
-      ).rejects.toBeInstanceOf(ContentRefusedError)
-      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, 'all')
-      expect(mockFindRowMatches).not.toHaveBeenCalled()
-    })
-
-    it('refuses an update by filter over unsafe cells before changing anything', async () => {
-      mockTableHasCellsUnsafe.mockResolvedValue(true)
-      await expect(
-        observeContentDelivery({ admit: gate(true) }, () =>
-          updateTableRows.execute({
-            principal: CHAT,
-            input: {
-              tableId: TABLE.id,
-              filter: { name: 'guess' },
-              data: { name: 'x' },
-              dataKeying: 'names',
-            },
-          })
-        )
-      ).rejects.toBeInstanceOf(ContentRefusedError)
-      expect(mockUpdateRowsByFilter).not.toHaveBeenCalled()
-    })
-
-    it('answers a person with the stored counts, unchecked', async () => {
-      const result = await query(PRINCIPAL, BY_NAME)
-      expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
-      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
-    })
-  })
-
   it.each(['read', 'enrichment'] as const)('%s refuses a refused row with a 403', async (name) => {
     mockRowProvenance.mockReturnValue({ status: 'unknown' })
     await expect(
@@ -1176,74 +1063,4 @@ describe('row delivery to Chat', () => {
       }
     )
   })
-
-  describe('row search for Chat', () => {
-    const MATCHES = [
-      { ordinal: 0, rowId: 'row-a', column: 'col-plain' },
-      { ordinal: 0, rowId: 'row-a', column: 'col-secret' },
-      { ordinal: 1, rowId: 'row-b', column: 'col-plain' },
-    ]
-    const READ_AT = new Date('2026-01-01')
-    const REVISIONS = new Map([
-      ['row-a', READ_AT],
-      ['row-b', READ_AT],
-    ])
-    const search = (principal: Caller) =>
-      searchTableRows.execute({ principal, input: { tableId: TABLE.id, q: 'needle' } })
-
-    beforeEach(() => {
-      mockClassifyColumns.mockResolvedValue(
-        new Map([
-          ['row-a', { status: 'exact', secretColumns: new Set(['col-secret']) }],
-          ['row-b', { status: 'unknown' }],
-        ])
-      )
-    })
-
-    it('does not signal truncation through a match it withheld', async () => {
-      mockFindRowMatches.mockResolvedValue({
-        matches: MATCHES,
-        truncated: true,
-        revisions: REVISIONS,
-      })
-      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
-      expect(result.matches).toEqual([MATCHES[0]])
-      expect(result.truncated).toBe(false)
-    })
-
-    it('keeps truncation when every match on a capped page was admitted', async () => {
-      mockFindRowMatches.mockResolvedValue({
-        matches: [MATCHES[0]],
-        truncated: true,
-        revisions: REVISIONS,
-      })
-      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
-      expect(result).toMatchObject({ matches: [MATCHES[0]], truncated: true })
-    })
-
-    it('classifies each match at the revision the search read, dropping one it cannot bind', async () => {
-      mockFindRowMatches.mockResolvedValue({
-        matches: MATCHES,
-        truncated: false,
-        revisions: new Map([['row-a', READ_AT]]),
-      })
-      const result = await observeContentDelivery({ admit: gate(true) }, () => search(CHAT))
-      expect(mockClassifyColumns).toHaveBeenCalledWith([
-        { id: 'row-a', updatedAt: READ_AT },
-        { id: 'row-a', updatedAt: READ_AT },
-      ])
-      expect(result.matches).toEqual([MATCHES[0]])
-    })
-
-    it('answers a person with every match and the raw truncation', async () => {
-      mockFindRowMatches.mockResolvedValue({
-        matches: MATCHES,
-        truncated: true,
-        revisions: REVISIONS,
-      })
-      const result = await search(PRINCIPAL)
-      expect(result).toMatchObject({ matches: MATCHES, truncated: true })
-      expect(mockClassifyColumns).not.toHaveBeenCalled()
-    })
-  })
 })
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index f9ee110254e..18e34b35a2f 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -14,16 +14,12 @@ import {
   mustClassifyContent,
 } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import {
-  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
-  isPrivateSecretProvenanceScopeCompatible,
-} from '@/lib/execution/durable-secret-provenance'
+import { isPrivateSecretProvenanceScopeCompatible } from '@/lib/execution/durable-secret-provenance'
 import type {
   BulkDeleteByIdsResult,
   BulkOperationResult,
   EnrichmentRunDetail,
   Filter,
-  PredicateNode,
   ReplaceRowsResult,
   RowData,
   RowExecutionMetadata,
@@ -90,12 +86,10 @@ import {
 import { assertCursorQueryBinding, decodeCursor } from '@/lib/table/rows/cursor'
 import { loadEnrichmentDetail, loadExecutionsForRow } from '@/lib/table/rows/executions'
 import {
-  classifyStoredTableRowColumns,
   createExactEmptyTableRowSecretProvenance,
   createTableRowSecretProvenanceFromRegistry,
   createUnknownTableRowSecretProvenance,
   TableRowProvenanceReader,
-  tableHasCellsUnsafeForPredicate,
 } from '@/lib/table/rows/secret-provenance'
 import type { FindRowMatch, RowWriteOptions } from '@/lib/table/rows/service'
 import { replaceTableRowsWithTx } from '@/lib/table/rows/service'
@@ -566,65 +560,6 @@ export interface QueryTableRowsResult extends TableResult {
   secretProvenance?: TableRowsProvenance
 }
 
-/**
- * The schema columns whose cells a predicate, filter or sort reads (storage ids). A field that is
- * not a schema column, such as the row id, reads no cell.
- */
-function cellColumnsRead(
-  table: TableDefinition,
-  query: { predicate?: TablePredicate; filter?: Filter; sort?: Sort }
-): Set<string> {
-  const schemaColumns = new Set(table.schema.columns.map(getColumnId))
-  const read = new Set<string>()
-  const note = (field: string) => {
-    if (schemaColumns.has(field)) read.add(field)
-  }
-  const walkPredicate = (node: PredicateNode): void => {
-    if ('field' in node) note(node.field)
-    else for (const child of 'all' in node ? node.all : node.any) walkPredicate(child)
-  }
-  const walkFilter = (filter: Filter): void => {
-    for (const [key, value] of Object.entries(filter)) {
-      if ((key === '$or' || key === '$and') && Array.isArray(value)) {
-        for (const child of value) walkFilter(child as Filter)
-      } else note(key)
-    }
-  }
-  if (query.predicate) walkPredicate(query.predicate)
-  if (query.filter) walkFilter(query.filter)
-  for (const field of Object.keys(query.sort ?? {})) note(field)
-  return read
-}
-
-/**
- * Runs a read whose rows, counts or page boundaries depend on cell values, for Chat only over a
- * table where those cells are all vouched for (see `tableHasCellsUnsafeForPredicate`). The check
- * runs before and after the read, so a row that becomes unsafe meanwhile refuses it too; a row
- * unsafe only between the two checks is the residual. Other callers read with no check.
- */
-async function requireCellsSafeForPredicate(
-  principal: Principal,
-  tableId: string,
-  columns: ReadonlySet<string> | 'all'
-): Promise<void> {
-  if (!isCopilotPrincipal(principal) || (columns !== 'all' && columns.size === 0)) return
-  if (await tableHasCellsUnsafeForPredicate(tableId, columns)) {
-    throw new ContentRefusedError('table-row')
-  }
-}
-
-async function readUnderCellPredicate<T>(
-  principal: Principal,
-  tableId: string,
-  columns: ReadonlySet<string> | 'all',
-  read: () => Promise<T>
-): Promise<T> {
-  await requireCellsSafeForPredicate(principal, tableId, columns)
-  const result = await read()
-  await requireCellsSafeForPredicate(principal, tableId, columns)
-  return result
-}
-
 export const queryTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.queryRows,
   resolveContext: ({ input }: { input: QueryTableRowsInput }) => resolveActiveTableContext(input),
@@ -695,34 +630,27 @@ export const queryTableRows = defineAuthorizedTableUseCase({
           if (column) columnIds.add(getColumnId(column))
         }
       }
-      const result = await readUnderCellPredicate(
-        principal,
-        context.table.id,
-        cellColumnsRead(context.table, { predicate, filter: legacyFilter, sort }),
-        () =>
-          queryRows(
-            context.table,
-            {
-              predicate,
-              filter: legacyFilter,
-              sort,
-              limit: input.limit,
-              after: cursor?.after ?? input.after,
-              offset: cursor?.offset ?? input.offset,
-              includeTotal: input.includeTotal ?? false,
-              withExecutions: input.includeRunState ?? false,
-              runStateBudgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
-              columnIds,
-            },
-            requestId(input),
-            readProvenance
-          )
+      const result = await queryRows(
+        context.table,
+        {
+          predicate,
+          filter: legacyFilter,
+          sort,
+          limit: input.limit,
+          after: cursor?.after ?? input.after,
+          offset: cursor?.offset ?? input.offset,
+          includeTotal: input.includeTotal ?? false,
+          withExecutions: input.includeRunState ?? false,
+          runStateBudgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
+          columnIds,
+        },
+        requestId(input),
+        readProvenance
       )
       const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
         ...result,
-        /** Chat's page count is what it was delivered; totals are safe once the read was allowed. */
         rowCount: isCopilotPrincipal(principal) ? rows.length : result.rowCount,
         rows: rowsForReader(principal, rows),
         ...(input.includePersistedSecretProvenance && readProvenance
@@ -735,50 +663,6 @@ export const queryTableRows = defineAuthorizedTableUseCase({
   },
 })
 
-/**
- * A match says a cell's text contains the query, which answers a question about that text even
- * though no value is returned. Chat keeps only matches in rows it could read and in cells holding
- * no recorded secret; every other caller sees every match.
- */
-async function admitRowMatches(
-  principal: Principal,
-  matches: FindRowMatch[],
-  revisions: ReadonlyMap<string, Date | string>
-): Promise<FindRowMatch[]> {
-  if (matches.length === 0 || !mustClassifyContent(principal)) {
-    await admitContent(principal, [])
-    return matches
-  }
-  /** Classified at the revision the search matched, so a later write cannot vouch for it. */
-  const columns = await classifyStoredTableRowColumns(
-    matches.flatMap((match) => {
-      const updatedAt = revisions.get(match.rowId)
-      return updatedAt === undefined ? [] : [{ id: match.rowId, updatedAt }]
-    })
-  )
-  const sources = [...columns].map(([rowId, classification]) => ({
-    kind: 'table-row' as const,
-    id: rowId,
-    provenance:
-      classification.status === 'exact'
-        ? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE
-        : ({ status: 'unknown' } as const),
-    view: 'opaque' as const,
-  }))
-  const admission = await admitContent(principal, sources)
-  const admitted = new Set(
-    sources.filter((source) => admission.admits(source)).map((source) => source.id)
-  )
-  return matches.filter((match) => {
-    const classification = columns.get(match.rowId)
-    return (
-      admitted.has(match.rowId) &&
-      classification?.status === 'exact' &&
-      !classification.secretColumns.has(match.column)
-    )
-  })
-}
-
 export interface SearchTableRowsInput extends TableScopedInput {
   q: string
   predicate?: TablePredicate
@@ -793,7 +677,7 @@ export interface SearchTableRowsResult extends TableResult {
 export const searchTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.searchRows,
   resolveContext: ({ input }: { input: SearchTableRowsInput }) => resolveActiveTableContext(input),
-  async execute({ principal, input, context }): Promise<SearchTableRowsResult> {
+  async execute({ input, context }): Promise<SearchTableRowsResult> {
     try {
       if (input.q.length === 0) {
         throw new TableRowsValidationError('q must be a non-empty search string')
@@ -807,21 +691,12 @@ export const searchTableRows = defineAuthorizedTableUseCase({
         const translated = sortSpecNamesToIds(input.sort, buildIdByName(context.table.schema))
         sort = Object.fromEntries(translated.map((item) => [item.field, item.direction]))
       }
-      /** Free text is matched against every column, so every column's cells are read. */
-      const result = await readUnderCellPredicate(principal, context.table.id, 'all', () =>
-        findRowMatches(context.table, { q: input.q, filter, sort }, requestId(input))
+      const result = await findRowMatches(
+        context.table,
+        { q: input.q, filter, sort },
+        requestId(input)
       )
-      const matches = await admitRowMatches(principal, result.matches, result.revisions)
-      return {
-        table: context.table,
-        matches,
-        /**
-         * A capped search that withheld a match cannot say whether what lies past the cap is
-         * admissible, so truncation is reported only when every match on the page was admitted;
-         * otherwise a refused match would be signalled through the flag alone.
-         */
-        truncated: result.truncated && matches.length === result.matches.length,
-      }
+      return { table: context.table, ...result }
     } catch (error) {
       rethrowQueryValidation(error)
     }
@@ -1493,12 +1368,6 @@ export const updateTableRows = defineAuthorizedTableUseCase({
         context.table,
         input.filterKeying ?? 'names'
       )
-      /** The affected count answers the filter's question, so Chat filters only vouched cells. */
-      await requireCellsSafeForPredicate(
-        principal,
-        context.table.id,
-        cellColumnsRead(context.table, { filter })
-      )
       const result = await updateRowsByFilter(
         context.table,
         {
@@ -1685,7 +1554,7 @@ export type DeleteTableRowsResult = TableResult &
 export const deleteTableRows = defineAuthorizedTableUseCase({
   operation: tableOperations.deleteRows,
   resolveContext: ({ input }: { input: DeleteTableRowsInput }) => resolveActiveTableContext(input),
-  async execute({ principal, input, context }): Promise<DeleteTableRowsResult> {
+  async execute({ input, context }): Promise<DeleteTableRowsResult> {
     try {
       if (input.kind === 'ids') {
         if (input.rowIds.length < 1 || input.rowIds.length > TABLE_LIMITS.MAX_BULK_OPERATION_SIZE) {
@@ -1712,11 +1581,6 @@ export const deleteTableRows = defineAuthorizedTableUseCase({
         context.table,
         input.filterKeying ?? 'names'
       )
-      await requireCellsSafeForPredicate(
-        principal,
-        context.table.id,
-        cellColumnsRead(context.table, { filter })
-      )
       const result = await deleteRowsByFilter(
         context.table,
         {
diff --git a/apps/sim/lib/table/import-provenance.integration.ts b/apps/sim/lib/table/import-provenance.integration.ts
new file mode 100644
index 00000000000..40ba3e4425c
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.integration.ts
@@ -0,0 +1,187 @@
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { db } from '@sim/db'
+import {
+  auditLog,
+  tableJobs,
+  user,
+  userStats,
+  userTableDefinitions,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { tableBillingMock, tableBillingMockFns } from '@sim/testing/mocks/table-billing.mock'
+import { tableEventsMock } from '@sim/testing/mocks/table-events.mock'
+import { tableTriggerMock } from '@sim/testing/mocks/table-trigger.mock'
+import { tableWorkflowColumnsMock } from '@sim/testing/mocks/table-workflow-columns.mock'
+import { generateId } from '@sim/utils/id'
+import { eq } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/lib/table/billing', () => tableBillingMock)
+vi.mock('@/lib/table/events', () => tableEventsMock)
+vi.mock('@/lib/table/trigger', () => tableTriggerMock)
+vi.mock('@/lib/table/workflow-columns', () => tableWorkflowColumnsMock)
+
+import { encryptSecret } from '@/lib/core/security/encryption'
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { runTableImport } from '@/lib/table/import-runner'
+import { markTableJobRunningInWorkspace } from '@/lib/table/jobs/service'
+import { TableRowProvenanceReader } from '@/lib/table/rows/secret-provenance'
+import { queryRows } from '@/lib/table/rows/service'
+import { getTableById } from '@/lib/table/service'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/** Whitespace is part of this recorded value, not a new matching normalization. */
+const SECRET = '  csv-source-secret-012345  '
+const PADDED_SHORT = ['        x', 'x        ', '    x    ']
+const QUOTED_OVERLAP = `${SECRET.trimStart()} | ${SECRET} | ${SECRET.trimEnd()}`
+const ORDINARY_VALUES: Record<string, string> = {
+  clean: 'ordinary value',
+  skipped: 'visible',
+  'short-prefix': 'xylophone',
+  'short-suffix': 'phoenix',
+  'short-whole': 'x',
+}
+
+describe('stored CSV imports preserve lineage through parsing and persistence', () => {
+  const userId = generateId()
+  const workspaceId = generateId()
+
+  beforeAll(async () => {
+    storage.root = mkdtempSync(path.join(tmpdir(), 'sim-import-lineage-'))
+    tableBillingMockFns.mockAssertRowCapacity.mockResolvedValue(10_000)
+    await db.insert(user).values({
+      id: userId,
+      name: 'CSV lineage fixture',
+      email: `${userId}@csv-lineage.test`,
+      emailVerified: true,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+    await db.insert(userStats).values({ id: generateId(), userId })
+    await insertWorkspaceFixture(db, {
+      id: workspaceId,
+      name: 'CSV lineage fixture',
+      ownerId: userId,
+      billedAccountUserId: userId,
+    })
+  })
+
+  afterAll(async () => {
+    await db.delete(auditLog).where(eq(auditLog.workspaceId, workspaceId))
+    await deleteWorkspaceFixture(db, eq(workspace.id, workspaceId))
+    await db.delete(user).where(eq(user.id, userId))
+    await rm(storage.root, { recursive: true, force: true })
+  })
+
+  it('protects a trimmed source value while preserving quoted, clean and skipped cells', async () => {
+    const tableId = generateId()
+    const importId = generateId()
+    await db.insert(userTableDefinitions).values({
+      id: tableId,
+      workspaceId,
+      name: tableId,
+      createdBy: userId,
+      schema: {
+        columns: [
+          { id: 'kind', name: 'kind', type: 'string' },
+          { id: 'value', name: 'value', type: 'string' },
+        ],
+      },
+    })
+    const source = await uploadWorkspaceFile(
+      workspaceId,
+      userId,
+      Buffer.from(
+        'kind,value,ignored\r\n' +
+          `trimmed,${SECRET},none\r\n` +
+          `quoted,"${SECRET}",none\r\n` +
+          `quoted-overlap,"${QUOTED_OVERLAP}",none\r\n` +
+          `short-prefix,xylophone,"${PADDED_SHORT[0]}"\r\n` +
+          `short-suffix,phoenix,"${PADDED_SHORT[1]}"\r\n` +
+          `short-whole,x,"${PADDED_SHORT[2]}"\r\n` +
+          'clean,  ordinary value  ,none\r\n' +
+          `skipped,visible,"${SECRET}"\r\n` +
+          `"multiline,\nquoted",${SECRET},none\r\n`
+      ),
+      `${importId}.csv`,
+      'text/csv',
+      {
+        secretProvenance: {
+          status: 'exact',
+          entries: [
+            {
+              name: 'CSV_SOURCE',
+              encryptedValue: (await encryptSecret(SECRET)).encrypted,
+              sourceUserId: userId,
+              sourceWorkspaceId: workspaceId,
+            },
+            ...(await Promise.all(
+              PADDED_SHORT.map(async (value, index) => ({
+                name: `PADDED_${index}`,
+                encryptedValue: (await encryptSecret(value)).encrypted,
+                sourceUserId: userId,
+                sourceWorkspaceId: workspaceId,
+              }))
+            )),
+          ],
+        },
+        notifyWorkspaceChange: false,
+      }
+    )
+    expect(await markTableJobRunningInWorkspace(tableId, workspaceId, importId, 'import')).toBe(
+      true
+    )
+    await runTableImport({
+      importId,
+      tableId,
+      workspaceId,
+      userId,
+      fileKey: source.key,
+      fileName: source.name,
+      delimiter: ',',
+      mode: 'append',
+      mapping: { kind: 'kind', value: 'value', ignored: null },
+      deleteSourceFile: false,
+    })
+    const [job] = await db.select().from(tableJobs).where(eq(tableJobs.id, importId))
+    expect(job).toMatchObject({ status: 'ready', rowsProcessed: 9, error: null })
+    const reader = new TableRowProvenanceReader({ userId, workspaceId })
+    const table = await getTableById(tableId)
+    if (!table) throw new Error('Imported fixture table disappeared')
+    const result = await queryRows(table, { limit: 10 }, generateId(), reader)
+    expect(result.rows).toHaveLength(9)
+    for (const row of result.rows) {
+      const provenance = reader.rowProvenance(row.id)
+      if (row.data.kind === 'trimmed' || row.data.kind === 'multiline,\nquoted') {
+        expect(row.data.value).toBe(SECRET.trim())
+        expect(provenance).toEqual({ status: 'unknown' })
+      } else if (row.data.kind === 'quoted' || row.data.kind === 'quoted-overlap') {
+        const expected = row.data.kind === 'quoted' ? SECRET : QUOTED_OVERLAP
+        expect(row.data.value).toBe(expected)
+        expect.soft(provenance.status).toBe('exact')
+        if (provenance.status !== 'exact') continue
+        const registry = new ResolvedSecretTraceRegistry([], { userId, workspaceId })
+        expect(await importDurableSecretProvenance(registry, provenance)).toBe(true)
+        expect(projectResolvedSecretModelContent(row.data.value, registry)).toEqual({
+          safe: true,
+          value: expected.replace(SECRET, '{{CSV_SOURCE}}'),
+        })
+      } else {
+        expect(row.data.value).toBe(ORDINARY_VALUES[String(row.data.kind)])
+        expect.soft(provenance).toEqual({ status: 'exact', entries: [] })
+      }
+    }
+  })
+})
diff --git a/apps/sim/lib/table/import-provenance.ts b/apps/sim/lib/table/import-provenance.ts
index 6abaa5445d1..6353d36775e 100644
--- a/apps/sim/lib/table/import-provenance.ts
+++ b/apps/sim/lib/table/import-provenance.ts
@@ -7,11 +7,12 @@ import {
 } from '@/lib/table/rows/secret-provenance'
 import type { RowData, TableRowSecretProvenanceWrite, TableSchema } from '@/lib/table/types'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { isNonIdentifyingSecretLiteral } from '@/executor/utils/resolved-secret-match-policy'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * Stamps each imported row with the provenance its cells inherit from the source file. `source`
- * is the row's text as the file held it, keyed by column id, before coercion rewrote any cell.
+ * holds parsed CSV cells, keyed by column id, before column coercion rewrote any value.
  */
 export type ImportedRowProvenance = (
   row: RowData,
@@ -46,6 +47,23 @@ export async function resolveImportedRowProvenance(source: {
   if (!(await importDurableSecretProvenance(registry, provenance))) {
     return createUnknownTableRowSecretProvenance
   }
+  const snapshot = registry.getModelEgressSnapshot()
+  if (!snapshot.complete) return createUnknownTableRowSecretProvenance
+  const trimmedCandidates = snapshot.matches.flatMap(({ plaintext }) => {
+    const start = plaintext.trimStart()
+    const end = plaintext.trimEnd()
+    const whole = plaintext.trim()
+    const candidate = {
+      plaintext,
+      start: start !== plaintext && !isNonIdentifyingSecretLiteral(start) ? start : undefined,
+      end: end !== plaintext && !isNonIdentifyingSecretLiteral(end) ? end : undefined,
+      whole:
+        start !== plaintext && end !== plaintext && !isNonIdentifyingSecretLiteral(whole)
+          ? whole
+          : undefined,
+    }
+    return candidate.start || candidate.end || candidate.whole ? [candidate] : []
+  })
   return (row, source) => {
     /**
      * Coercion can rewrite a secret (a number parsed, a date normalized) into text redaction no
@@ -53,7 +71,21 @@ export async function resolveImportedRowProvenance(source: {
      */
     for (const [columnId, raw] of Object.entries(source ?? {})) {
       const stored = row[columnId]
-      if (stored === null || stored === undefined || Object.is(stored, raw)) continue
+      if (stored === null || stored === undefined) continue
+      /** CSV trims unquoted field edges before coercion sees them; source candidates stay exact. */
+      if (
+        typeof raw === 'string' &&
+        trimmedCandidates.some(
+          ({ plaintext, start, end, whole }) =>
+            !raw.includes(plaintext) &&
+            ((start !== undefined && raw.startsWith(start)) ||
+              (end !== undefined && raw.endsWith(end)) ||
+              (whole !== undefined && raw === whole))
+        )
+      ) {
+        return createUnknownTableRowSecretProvenance()
+      }
+      if (Object.is(stored, raw)) continue
       const rawProvenance = registry.exportCommittedProvenanceForValue(raw)
       if (!rawProvenance.complete || rawProvenance.entries.length > 0) {
         return createUnknownTableRowSecretProvenance()
@@ -64,8 +96,8 @@ export async function resolveImportedRowProvenance(source: {
 }
 
 /**
- * Each parsed row's cells as the file held them, keyed by the column id coercion writes, aligned
- * with what `coerceRowsForTable` returns for the same rows.
+ * Parsed cells before column coercion, keyed by the column id it writes and aligned with
+ * what `coerceRowsForTable` returns for the same rows.
  */
 export function importedRowSources(
   rows: readonly Record<string, unknown>[],
diff --git a/apps/sim/lib/table/rows/secret-provenance.test.ts b/apps/sim/lib/table/rows/secret-provenance.test.ts
index 74925491df8..7cf5401b4eb 100644
--- a/apps/sim/lib/table/rows/secret-provenance.test.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.test.ts
@@ -5,7 +5,6 @@ import { eq } from 'drizzle-orm'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DbTransaction } from '@/lib/table/planner'
 import {
-  classifyStoredTableRowColumns,
   classifyTableRowSecretProvenanceForCopy,
   getTableSnapshotModelMountSafety,
   loadTableRowSecretProvenance,
@@ -298,49 +297,6 @@ describe('table row secret provenance', () => {
     })
   })
 
-  it('classifies matched columns only at the revision the search read', async () => {
-    const SECRET_ENTRY = {
-      columnId: 'secret-column',
-      encryptedValue: 'encrypted-local',
-      name: 'LOCAL_SECRET',
-      sourceUserId: 'user-1',
-      sourceWorkspaceId: 'workspace-1',
-    }
-    const later = new Date(ROW_UPDATED_AT.getTime() + 1)
-    queueTableRows(userTableRows, [
-      {
-        id: 'read-row',
-        updatedAt: ROW_UPDATED_AT,
-        secretProvenanceVersion: 1,
-        sidecarRowId: 'read-row',
-        sidecarStatus: 'exact',
-        sidecarEntries: [SECRET_ENTRY],
-        sidecarIsCurrent: true,
-      },
-      {
-        id: 'rewritten-row',
-        updatedAt: later,
-        secretProvenanceVersion: 1,
-        sidecarRowId: 'rewritten-row',
-        sidecarStatus: 'exact',
-        sidecarEntries: [],
-        sidecarIsCurrent: true,
-      },
-    ])
-    const columns = await classifyStoredTableRowColumns([
-      { id: 'read-row', updatedAt: ROW_UPDATED_AT },
-      { id: 'rewritten-row', updatedAt: ROW_UPDATED_AT },
-      { id: 'missing-row', updatedAt: ROW_UPDATED_AT },
-    ])
-    expect(columns.get('read-row')).toEqual({
-      status: 'exact',
-      secretColumns: new Set(['secret-column']),
-    })
-    /** Its clean sidecar describes text written after the match: it cannot vouch for the match. */
-    expect(columns.get('rewritten-row')).toEqual({ status: 'unknown' })
-    expect(columns.get('missing-row')).toEqual({ status: 'unknown' })
-  })
-
   it('rejects contradictory duplicate row crossings before reading provenance', async () => {
     await expect(
       loadTableRowSecretProvenance(
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index 33dbf64b9d8..1d49c72e252 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -946,127 +946,6 @@ async function classifyTableRowCrossings(
   return result
 }
 
-/**
- * Whether a predicate over `columnIds` (every column, for `'all'`) could answer a question about
- * text Chat may not read: some row of the table cannot be vouched for (tracked, with a missing,
- * stale, non-exact or malformed sidecar), or some row records a secret in a column the predicate
- * reads. A predicate's matches, counts and page boundaries all depend on such cells, so Chat runs
- * one only over a table where none exist. The answer is the same whatever the predicate asks, so
- * the refusal itself reveals nothing about any cell.
- */
-export async function tableHasCellsUnsafeForPredicate(
-  tableId: string,
-  columnIds: ReadonlySet<string> | 'all',
-  executor: DbExecutor = db
-): Promise<boolean> {
-  const entries = sql`CASE WHEN jsonb_typeof(${userTableRowSecretProvenance.entries}) = 'array'
-    THEN ${userTableRowSecretProvenance.entries} ELSE '[]'::jsonb END`
-  const referenced =
-    columnIds === 'all'
-      ? sql`true`
-      : columnIds.size === 0
-        ? sql`false`
-        : sql`entry->>'columnId' IN (${sql.join(
-            [...columnIds].map((columnId) => sql`${columnId}`),
-            sql`, `
-          )})`
-  const optionalText = (key: string) =>
-    sql`(jsonb_exists(entry, ${key}) AND (jsonb_typeof(entry->${key}) IS DISTINCT FROM 'string' OR entry->>${key} = ''))`
-  const [row] = await executor
-    .select({ id: userTableRows.id })
-    .from(userTableRows)
-    .leftJoin(
-      userTableRowSecretProvenance,
-      eq(userTableRowSecretProvenance.rowId, userTableRows.id)
-    )
-    .where(
-      and(
-        eq(userTableRows.tableId, tableId),
-        sql`${userTableRows.secretProvenanceVersion} IS NOT NULL`,
-        sql`(${userTableRows.secretProvenanceVersion} <> ${TABLE_ROW_SECRET_PROVENANCE_VERSION}
-          OR ${userTableRowSecretProvenance.status} IS DISTINCT FROM 'exact'
-          OR ${userTableRowSecretProvenance.contentUpdatedAt} IS DISTINCT FROM ${userTableRows.updatedAt}
-          OR jsonb_typeof(${userTableRowSecretProvenance.entries}) IS DISTINCT FROM 'array'
-          OR EXISTS (
-            SELECT 1 FROM jsonb_array_elements(${entries}) AS entry
-            WHERE CASE WHEN jsonb_typeof(entry) <> 'object' THEN true ELSE (
-              jsonb_typeof(entry->'columnId') IS DISTINCT FROM 'string'
-              OR entry->>'columnId' = ''
-              OR jsonb_typeof(entry->'encryptedValue') IS DISTINCT FROM 'string'
-              OR entry->>'encryptedValue' = ''
-              OR ${optionalText('name')}
-              OR ${optionalText('sourceUserId')}
-              OR ${optionalText('sourceWorkspaceId')}
-              OR EXISTS (
-                SELECT 1 FROM jsonb_object_keys(entry) AS key
-                WHERE key NOT IN (${sql.join(
-                  [...STORED_ENTRY_KEYS].map((key) => sql`${key}`),
-                  sql`, `
-                )})
-              )
-              OR ${referenced}
-            ) END
-          ))`
-      )
-    )
-    .limit(1)
-  return row !== undefined
-}
-
-/**
- * For each row as it was read, the columns whose cells hold a recorded secret, or `unknown` when
- * the row cannot be vouched for. A match oracle (row search) consults it: a cell that matched
- * reveals something about its text whatever the result shows. A row whose stored revision is no
- * longer the one the caller read is `unknown`: its sidecar describes other text.
- */
-export async function classifyStoredTableRowColumns(
-  rows: readonly { id: string; updatedAt: Date | string }[],
-  executor: DbExecutor = db
-): Promise<Map<string, { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }>> {
-  const readAt = new Map<string, Date | string>()
-  const conflicting = new Set<string>()
-  for (const row of rows) {
-    const seen = readAt.get(row.id)
-    if (seen !== undefined && !sameTimestamp(seen, row.updatedAt)) conflicting.add(row.id)
-    readAt.set(row.id, row.updatedAt)
-  }
-  const ids = [...readAt.keys()]
-  const currentRows = await selectRowsWithSidecars(executor, ids)
-  const result = new Map<
-    string,
-    { status: 'exact'; secretColumns: Set<string> } | { status: 'unknown' }
-  >()
-  for (const current of currentRows) {
-    const expected = readAt.get(current.id)
-    if (
-      conflicting.has(current.id) ||
-      expected === undefined ||
-      !sameTimestamp(current.updatedAt, expected)
-    ) {
-      result.set(current.id, { status: 'unknown' })
-      continue
-    }
-    if (current.secretProvenanceVersion === null) {
-      result.set(current.id, { status: 'exact', secretColumns: new Set() })
-      continue
-    }
-    const parsed =
-      current.secretProvenanceVersion === TABLE_ROW_SECRET_PROVENANCE_VERSION &&
-      current.sidecarStatus === 'exact' &&
-      current.sidecarIsCurrent
-        ? normalizeStoredEntries(current.sidecarEntries)
-        : undefined
-    result.set(
-      current.id,
-      parsed
-        ? { status: 'exact', secretColumns: new Set(parsed.map((entry) => entry.columnId)) }
-        : { status: 'unknown' }
-    )
-  }
-  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
-  return result
-}
-
 /**
  * Builds one bounded provenance envelope for rows crossing an authenticated
  * internal table boundary. Untracked legacy rows contribute an exact-empty
diff --git a/apps/sim/lib/table/rows/service.ts b/apps/sim/lib/table/rows/service.ts
index cc10af853b3..b0ce412afdc 100644
--- a/apps/sim/lib/table/rows/service.ts
+++ b/apps/sim/lib/table/rows/service.ts
@@ -1101,13 +1101,12 @@ export async function findRowMatches(
 ): Promise<{
   matches: FindRowMatch[]
   truncated: boolean
-  revisions: ReadonlyMap<string, Date | string>
 }> {
   const tableName = USER_TABLE_ROWS_SQL_NAME
   const columns = table.schema.columns
   // Row data is keyed by stable column id, so scan/return JSONB keys as ids.
   const columnIds = columns.map(getColumnId)
-  if (columnIds.length === 0) return { matches: [], truncated: false, revisions: new Map() }
+  if (columnIds.length === 0) return { matches: [], truncated: false }
 
   // Same visibility rule as queryRows: don't surface rows a running delete job will remove.
   const deleteMask = await pendingDeleteMask(table)
@@ -1149,17 +1148,14 @@ export async function findRowMatches(
     return trx.execute<{
       ordinal: string | number
       id: string
-      updated_at_ms: string | number
       column_name: string
     }>(sql`
       WITH ordered AS (
-        SELECT id, data, updated_at, row_number() OVER (ORDER BY ${orderBySql}) - 1 AS ordinal
+        SELECT id, data, row_number() OVER (ORDER BY ${orderBySql}) - 1 AS ordinal
         FROM ${userTableRows}
         WHERE ${whereClause}
       )
-      SELECT o.ordinal, o.id,
-        floor(extract(epoch FROM o.updated_at) * 1000)::bigint AS updated_at_ms,
-        kv.key AS column_name
+      SELECT o.ordinal, o.id, kv.key AS column_name
       FROM ordered o
       CROSS JOIN LATERAL jsonb_each_text(o.data) kv
       WHERE (kv.value ILIKE ${pattern}${nameMatchClause})
@@ -1177,18 +1173,12 @@ export async function findRowMatches(
     rowId: r.id,
     column: r.column_name,
   }))
-  /**
-   * The revision each match was read at, for a caller that classifies what matched. Read as epoch
-   * milliseconds: the raw driver returns this zone-less timestamp as local-time text with
-   * microseconds, which would never equal the ORM's UTC, millisecond `Date` for the same row.
-   */
-  const revisions = new Map(sliced.map((r) => [r.id, new Date(Number(r.updated_at_ms))]))
 
   logger.info(
     `[${requestId}] Find "${options.q}" in table ${table.id}: ${matches.length} match(es)${truncated ? ' (truncated)' : ''}`
   )
 
-  return { matches, truncated, revisions }
+  return { matches, truncated }
 }
 
 /**
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.test.ts b/apps/sim/lib/tool-execution/application/execute-tool.test.ts
index 6b6fb45dc49..fc13882fb25 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.test.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.test.ts
@@ -1,6 +1,5 @@
 import type { PersonalApiKeyPrincipal, SessionPrincipal } from '@sim/auth/principal'
 import {
-  createDelegatedPrincipal,
   createPersonalApiKeyPrincipal,
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
@@ -312,33 +311,6 @@ describe('executeToolForCaller', () => {
     }
   )
 
-  it('refuses Chat a tool whose result carries secret provenance, before dispatch', async () => {
-    toolsMockFns.mockToolResultCarriesSecretProvenance.mockImplementation(
-      (toolId: string) => toolId === 'file_read'
-    )
-    const chat = createDelegatedPrincipal({
-      workspaceId: WORKSPACE_ID,
-      audience: 'sim:tool-execution',
-    })
-    await expect(
-      executeToolForCaller.execute({
-        principal: chat,
-        input: { workspaceId: WORKSPACE_ID, toolId: 'file_read', input: { fileId: 'file-1' } },
-      })
-    ).rejects.toMatchObject({ code: 'forbidden' })
-    expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
-
-    /** The same tool still runs for a person. */
-    mocks.executeRegistryTool.mockResolvedValue({ success: true, output: { files: [] } })
-    await expect(
-      executeToolForCaller.execute({
-        principal,
-        input: { workspaceId: WORKSPACE_ID, toolId: 'file_read', input: { fileId: 'file-1' } },
-      })
-    ).resolves.toMatchObject({ status: 'succeeded' })
-    toolsMockFns.mockToolResultCarriesSecretProvenance.mockReturnValue(false)
-  })
-
   it.each(['callerPrincipal', 'principal', 'operationContext', '_context'])(
     'rejects caller input attempting to supply %s authority',
     async (key) => {
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.ts b/apps/sim/lib/tool-execution/application/execute-tool.ts
index 748e6873b7c..7c92eb0ea14 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.ts
@@ -14,16 +14,18 @@ import {
   resolveVisibleToolOwners,
 } from '@/lib/catalog/application/tool-scope'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
-import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
+import { admitWrittenContent, mustClassifyContent } from '@/lib/core/application/content-delivery'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getEffectiveDecryptedEnv } from '@/lib/environment/utils'
+import { durableSecretProvenanceFromRegistry } from '@/lib/execution/durable-secret-provenance'
 import { principalUserId } from '@/lib/integrations/principal-scope.server'
 import { toolExecutionOperations } from '@/lib/tool-execution/application/operations'
 import { isEnvVarReference } from '@/executor/constants'
 import { resolveEnvVarReferences } from '@/executor/utils/reference-validation'
-import { executeTool as executeRegistryTool, toolResultCarriesSecretProvenance } from '@/tools'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { executeTool as executeRegistryTool } from '@/tools'
 import type { ExecutableToolConfig } from '@/tools/types'
 import { getTool } from '@/tools/utils'
 
@@ -315,16 +317,6 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
 
     const tool = getTool(toolId)
     if (!tool) throw new OrchestrationError('not_found', 'Tool not found')
-    /**
-     * This route runs a tool with no secret registry, so a result that carries provenance would
-     * reach Chat's model unprojected. Chat reads that content through its own commands instead.
-     */
-    if (isCopilotPrincipal(principal) && toolResultCarriesSecretProvenance(toolId)) {
-      throw new OrchestrationError(
-        'forbidden',
-        `${toolId} returns stored workspace content, which Chat reads through its files, knowledge and tables commands instead`
-      )
-    }
     assertNoUndeclaredInputs(tool, toolId, input.input)
 
     const selector = declaredCredentialSelector(tool)
@@ -355,6 +347,10 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
       throw new OrchestrationError('forbidden', 'Tool execution requires an acting user')
     }
 
+    const registry = mustClassifyContent(principal)
+      ? new ResolvedSecretTraceRegistry([], { userId, workspaceId: context.workspaceId })
+      : undefined
+
     const billingAttribution = await resolveBillingAttribution({
       actorUserId: userId,
       workspaceId: context.workspaceId,
@@ -406,6 +402,7 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
     const callId = generateId()
 
     const result = await executeRegistryTool(toolId, params, {
+      resolvedSecretTraceRegistry: registry,
       signal: AbortSignal.timeout((input.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1000),
       operationContext: {
         /**
@@ -416,6 +413,7 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
          */
         workflowId: '',
         callerPrincipal: principal,
+        resolvedSecretTraceRegistry: registry,
         userId,
         workspaceId: context.workspaceId,
         billingAttribution,
@@ -453,6 +451,20 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
       })
     }
 
+    await admitWrittenContent(
+      principal,
+      registry
+        ? [
+            {
+              kind: 'tool-result',
+              id: callId,
+              provenance: durableSecretProvenanceFromRegistry(registry, result),
+              view: 'complete',
+            },
+          ]
+        : []
+    )
+
     return {
       toolId,
       status: result.success ? 'succeeded' : 'failed',
diff --git a/apps/sim/lib/tool-execution/application/operations.ts b/apps/sim/lib/tool-execution/application/operations.ts
index 2092ffa78c9..b29bd05d233 100644
--- a/apps/sim/lib/tool-execution/application/operations.ts
+++ b/apps/sim/lib/tool-execution/application/operations.ts
@@ -37,6 +37,6 @@ export const toolExecutionOperations = {
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
-    contentDelivery: 'none',
+    contentDelivery: 'sourced',
   }),
 } as const
diff --git a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
index 6fa377e1621..f5717820a0c 100644
--- a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
@@ -35,8 +35,8 @@ import {
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { runCli } from '@/lib/mothership/agent-cli/run-cli'
-import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
 import { WORKSPACE_FILE_STORAGE_CLEANUP_OUTBOX_EVENT } from '@/lib/uploads/contexts/workspace/file-outbox-events'
 import {
   deleteWorkspaceFileVersion,
@@ -58,13 +58,7 @@ import {
   queryWorkspaceFileVersions,
   releaseWorkspaceFileVersionsForPurgeInTx,
 } from '@/lib/uploads/contexts/workspace/workspace-file-versions'
-import { v2FileErrorPolicies } from '@/lib/workspace-files/api'
-import { presentWorkspaceFileText } from '@/lib/workspace-files/api/text-presenter'
-import {
-  downloadWorkspaceFileVersion,
-  readWorkspaceFileVersionText,
-  revertWorkspaceFileVersion,
-} from '@/lib/workspace-files/application/file-versions'
+import { revertWorkspaceFileVersion } from '@/lib/workspace-files/application/file-versions'
 import { revokeWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-access'
 import { runCleanupFileVersions } from '@/background/cleanup-file-versions'
 import { runCleanupSoftDeletes } from '@/background/cleanup-soft-deletes'
diff --git a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
index 6d20cbbe9df..5fc84fde354 100644
--- a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
@@ -989,12 +989,15 @@ export async function getBoundWorkspaceFileSecretProvenanceByIdentity(
       )
     for (const row of rows) rowsById.set(row.id, row)
   }
-  return new Map(
-    identities.map((identity) => [
+  const result = new Map<string, WorkspaceFileSecretProvenance>()
+  for (const identity of identities) {
+    if (result.get(identity.fileId)?.status === 'unknown') continue
+    result.set(
       identity.fileId,
-      bindWorkspaceFileSecretProvenance(identity, rowsById.get(identity.fileId)),
-    ])
-  )
+      bindWorkspaceFileSecretProvenance(identity, rowsById.get(identity.fileId))
+    )
+  }
+  return result
 }
 
 /**
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
index 74bbb6a9fb4..fed0f61af78 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.test.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -1,7 +1,10 @@
 /**
  * @vitest-environment node
  */
-import type { Principal } from '@sim/auth/principal'
+import {
+  createDelegatedPrincipal,
+  createExecutorPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import {
   workspaceFileSecretProvenanceMock,
   workspaceFileSecretProvenanceMockFns,
@@ -30,20 +33,8 @@ import {
 import type { UserFile } from '@/executor/types'
 
 const now = Date.now()
-function delegated(serviceId: string): Principal {
-  return {
-    kind: 'delegated',
-    serviceId,
-    subjectUserId: 'user-1',
-    workspaceId: 'workspace-1',
-    delegationId: 'delegation-1',
-    audience: 'sim:test',
-    issuedAt: new Date(now),
-    expiresAt: new Date(now + 60_000),
-  }
-}
-const CHAT = delegated('copilot')
-const EXECUTOR = delegated('executor')
+const CHAT = createDelegatedPrincipal()
+const EXECUTOR = createExecutorPrincipal()
 
 const ENTRY = { encryptedValue: 'ciphertext', sourceUserId: 'user-1' }
 
@@ -116,6 +107,22 @@ describe('admitRunFiles', () => {
 })
 
 describe('withholdUnadmittedInlineFiles', () => {
+  it.each(['clean', 'secret'])(
+    'handles deeply nested %s files without a call-stack limit',
+    async (kind) => {
+      let output: unknown = runFile(kind, { base64: 'Ynl0ZXM=' })
+      for (let depth = 0; depth < 12_000; depth++) output = [output]
+      const result = await observeContentDelivery(GATE, () =>
+        withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+      )
+      let leaf = result
+      while (Array.isArray(leaf)) leaf = leaf[0]
+      expect(leaf).toMatchObject({ id: `file-${kind}` })
+      if (kind === 'secret') expect(leaf).not.toHaveProperty('base64')
+      else expect(result).toBe(output)
+    }
+  )
+
   it('strips base64 only from files Chat may not receive, keeping their descriptors', async () => {
     const clean = runFile('clean', { base64: 'Y2xlYW4=' })
     const secret = runFile('secret', { base64: 'c2VjcmV0' })
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
index 7514a717d58..1b3e5fe44a6 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -10,10 +10,6 @@ import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import type { UserFile } from '@/executor/types'
 
-/**
- * Admits each file a run produced on its own, classified by the storage key the run recorded, and
- * returns the ids admitted. A caller no gate observes gets every id back without a provenance read.
- */
 /** Admits each run file on its own; see {@link admitRunFiles}. Returns the admitted files. */
 async function admitRunFileItems(
   principal: Principal,
@@ -38,6 +34,10 @@ async function admitRunFileItems(
   })
 }
 
+/**
+ * Admits each file a run produced on its own, classified by the storage key the run recorded, and
+ * returns the ids admitted. A caller no gate observes gets every id back without a provenance read.
+ */
 export async function admitRunFiles(
   principal: Principal,
   workspaceId: string,
@@ -53,66 +53,83 @@ export async function admitRunFiles(
  * id: an earlier descriptor of the same file without bytes must not hide a later one with them.
  */
 function collectInlinedFiles(value: unknown, files: Map<string, UserFile>, seen: WeakSet<object>) {
-  if (!value || typeof value !== 'object' || seen.has(value)) return
-  seen.add(value)
-  if (isUserFileWithMetadata(value)) {
-    if (typeof value.base64 === 'string' && !files.has(value.key)) files.set(value.key, value)
-    return
-  }
-  for (const item of Array.isArray(value) ? value : Object.values(value)) {
-    collectInlinedFiles(item, files, seen)
+  const pending: Iterator<unknown>[] = [[value].values()]
+  while (pending.length > 0) {
+    const iterator = pending[pending.length - 1]
+    const next = iterator.next()
+    if (next.done) {
+      pending.pop()
+      continue
+    }
+    const current = next.value
+    if (!current || typeof current !== 'object' || seen.has(current)) continue
+    seen.add(current)
+    if (isUserFileWithMetadata(current)) {
+      if (typeof current.base64 === 'string' && !files.has(current.key)) {
+        files.set(current.key, current)
+      }
+      continue
+    }
+    pending.push((Array.isArray(current) ? current : Object.values(current)).values())
   }
 }
 
-function withoutUnadmittedBase64(
-  value: unknown,
-  admittedKeys: ReadonlySet<string>,
-  seen: WeakMap<object, unknown>
-): unknown {
-  if (!value || typeof value !== 'object') return value
-  const copied = seen.get(value)
-  if (copied !== undefined) return copied
-  if (isUserFileWithMetadata(value)) {
-    if (typeof value.base64 !== 'string' || admittedKeys.has(value.key)) return value
-    const { base64: _withheld, ...described } = value
-    seen.set(value, described)
-    return described
-  }
-  /** Each copy is registered before its children are walked, so a cycle resolves to the copy. */
-  if (Array.isArray(value)) {
-    const items: unknown[] = []
-    seen.set(value, items)
-    for (const item of value) items.push(withoutUnadmittedBase64(item, admittedKeys, seen))
-    return items
-  }
-  /**
-   * Only plain data is rebuilt. Another object (a stream, response or date) passes through
-   * untouched unless it carries refused inline bytes, which cannot be removed without rebuilding
-   * it, so the result is refused instead.
-   */
-  const prototype = Object.getPrototypeOf(value)
-  if (prototype !== Object.prototype && prototype !== null) {
-    const held = new Map<string, UserFile>()
-    collectInlinedFiles(value, held, new WeakSet())
-    for (const file of held.values()) {
-      if (!admittedKeys.has(file.key)) {
-        throw new ContentRefusedError('execution-file')
+function withoutUnadmittedBase64(value: unknown, admittedKeys: ReadonlySet<string>): unknown {
+  const seen = new WeakMap<object, unknown>()
+  const pending: {
+    target: object
+    entries: Iterator<[string | number, unknown]>
+  }[] = []
+  const copy = (current: unknown): unknown => {
+    if (!current || typeof current !== 'object') return current
+    const copied = seen.get(current)
+    if (copied !== undefined) return copied
+    if (isUserFileWithMetadata(current)) {
+      if (typeof current.base64 !== 'string' || admittedKeys.has(current.key)) return current
+      const { base64: _withheld, ...described } = current
+      seen.set(current, described)
+      return described
+    }
+    /** Register the copy before scheduling its children so shared and cyclic references agree. */
+    if (Array.isArray(current)) {
+      const items: unknown[] = []
+      seen.set(current, items)
+      pending.push({ target: items, entries: current.entries() })
+      return items
+    }
+    /** Non-data objects keep their identity; refused bytes inside one cannot be removed safely. */
+    const prototype = Object.getPrototypeOf(current)
+    if (prototype !== Object.prototype && prototype !== null) {
+      const held = new Map<string, UserFile>()
+      collectInlinedFiles(current, held, new WeakSet())
+      for (const file of held.values()) {
+        if (!admittedKeys.has(file.key)) throw new ContentRefusedError('execution-file')
       }
+      return current
     }
-    return value
+    const record: Record<string, unknown> = prototype === null ? Object.create(null) : {}
+    seen.set(current, record)
+    pending.push({ target: record, entries: Object.entries(current).values() })
+    return record
   }
-  const record: Record<string, unknown> = prototype === null ? Object.create(null) : {}
-  seen.set(value, record)
-  for (const [key, item] of Object.entries(value)) {
-    /** Defined, not assigned: a `__proto__` key stays a key instead of replacing the prototype. */
-    Object.defineProperty(record, key, {
-      value: withoutUnadmittedBase64(item, admittedKeys, seen),
+  const result = copy(value)
+  while (pending.length > 0) {
+    const frame = pending[pending.length - 1]
+    const next = frame.entries.next()
+    if (next.done) {
+      pending.pop()
+      continue
+    }
+    const [key, item] = next.value
+    /** An own `__proto__` key remains data rather than replacing the copied object's prototype. */
+    Object.defineProperty(frame.target, key, {
+      value: copy(item),
       enumerable: true,
       writable: true,
       configurable: true,
     })
   }
-  return record
+  return result
 }
 
 /**
@@ -136,7 +153,7 @@ export async function withholdUnadmittedInlineFiles<T>(
   const admitted = await admitRunFileItems(principal, workspaceId, inlined, 'opaque')
   if (admitted.length === inlined.length) return value
   const admittedKeys = new Set(admitted.map((file) => file.key))
-  return withoutUnadmittedBase64(value, admittedKeys, new WeakMap()) as T
+  return withoutUnadmittedBase64(value, admittedKeys) as T
 }
 
 /**
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
index 0140d357053..a1decb186ed 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
@@ -60,18 +60,13 @@ const mockProvenance =
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
 
-const { mockGetUserPermissionConfig } = permissionGroupsResolveMockFns
+const { mockResolveVerifiedUserAccessControlContext: mockAccessContext } =
+  permissionGroupsResolveMockFns
 const {
   mockIsGeneratedDocumentSourceType: mockIsGenerated,
   mockIsRenderableDocumentName: mockIsRenderable,
 } = fileUtilsMockFns
 
-/** The use case passes the organization the authorized context already loaded. */
-permissionGroupsResolveMockFns.mockResolveVerifiedUserAccessControlContext.mockImplementation(
-  async (userId: string, workspaceId: string) => ({
-    config: await mockGetUserPermissionConfig(userId, workspaceId),
-  })
-)
 fileUtilsMockFns.mockFormatFileSize.mockImplementation((bytes: number) => `${bytes} bytes`)
 fileUtilsMockFns.mockNeedsRenderedArtifact.mockImplementation(
   (contentType: string | null | undefined, fileName: string) =>
@@ -128,7 +123,12 @@ describe('downloadWorkspaceFileItems', () => {
     mockIsGenerated.mockReturnValue(false)
     mockIsRenderable.mockReturnValue(false)
     mockIsDocNotReady.mockReturnValue(false)
-    mockGetUserPermissionConfig.mockResolvedValue(null)
+    mockAccessContext.mockResolvedValue({
+      organizationId: null,
+      entitled: false,
+      permissionGroup: null,
+      config: null,
+    })
     mockProvenance.mockImplementation(
       async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
         new Map(identities.map((identity) => [identity.fileId, { status: 'exact', entries: [] }]))
@@ -177,7 +177,7 @@ describe('downloadWorkspaceFileItems', () => {
       file('f1', 'clean.txt', null, 10),
       { ...file('f2', 'report.docx', null, 25), type: 'text/x-generated-document' },
     ])
-    mockIsGenerated.mockImplementation((type: string) => type === 'text/x-generated-document')
+    mockIsGenerated.mockImplementation((type) => type === 'text/x-generated-document')
     mockFetchServable.mockResolvedValue({
       buffer: Buffer.from('rendered'),
       contributingFiles: [{ fileId: 'c1', key: 'key-c1', context: 'workspace' }],
@@ -312,9 +312,14 @@ describe('downloadWorkspaceFileItems', () => {
 
   describe('permission-group capability', () => {
     beforeEach(() => {
-      mockGetUserPermissionConfig.mockResolvedValue({
-        ...DEFAULT_PERMISSION_GROUP_CONFIG,
-        disableBulkFileDownload: true,
+      mockAccessContext.mockResolvedValue({
+        organizationId: null,
+        entitled: true,
+        permissionGroup: null,
+        config: {
+          ...DEFAULT_PERMISSION_GROUP_CONFIG,
+          disableBulkFileDownload: true,
+        },
       })
       mockListFolders.mockResolvedValue([{ id: 'folder-1', parentId: null, name: 'Reports' }])
       mockListFiles.mockImplementation(async () => {
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index aad852b8a72..5f216d13a16 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -52,6 +52,7 @@ export interface DownloadWorkspaceFileItemsResult {
   folderPaths: Map<string, string>
   renderedDocuments: Map<string, Buffer>
   declaredBytes: number
+  excludedFileIds: string[]
 }
 
 function collectDescendantFolderIds(
@@ -232,7 +233,9 @@ async function executeDownloadWorkspaceFileItems({
     throw new ContentRefusedError('workspace-file')
   }
 
+  const included = new Set(filesToZip.map((file) => file.id))
   return {
+    excludedFileIds: selectedFiles.filter((file) => !included.has(file.id)).map((file) => file.id),
     filesToZip,
     folderPaths,
     renderedDocuments,
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 1225ba0b6f6..4aa7f109fbf 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -1,4 +1,5 @@
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   type ActiveWorkspaceFileContext,
@@ -48,17 +49,36 @@ async function executeReadWorkspaceFileContent({
     includeOwnedFiles: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
-  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
-  const content = await fetchWorkspaceFileBuffer(file, {
-    maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
-  })
   const secretProvenance = input.includeSecretProvenance
     ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
         fileId: file.id,
         key: file.key,
         context: file.storageContext ?? 'workspace',
+        contentUpdatedAt: file.contentUpdatedAt ?? undefined,
       })
     : undefined
+  await requireAdmittedWorkspaceFile(
+    principal,
+    context.workspaceId,
+    file,
+    'complete',
+    secretProvenance
+  )
+  let content: Buffer
+  try {
+    content = await fetchWorkspaceFileBuffer(file, {
+      maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
+    })
+  } catch (error) {
+    if (
+      isCopilotPrincipal(principal) &&
+      (secretProvenance?.status === 'unknown' ||
+        (secretProvenance?.status === 'exact' && secretProvenance.entries.length > 0))
+    ) {
+      throw new OrchestrationError('internal', 'File content could not be read')
+    }
+    throw error
+  }
   return {
     file,
     content,
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
index 0370f821797..ffaffda3cf0 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
@@ -35,7 +35,6 @@ import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-w
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { searchWorkspaceFileContent } from '@/lib/workspace-files/application/search-workspace-file-content'
-import { FILE_SEARCH_MAX_RESULTS } from '@/lib/workspace-files/search/constants'
 
 const mocks = {
   load: workspaceUploadsMockFns.mockLoadActiveWorkspaceContext,
@@ -77,7 +76,7 @@ describe('searchWorkspaceFileContent cancellation', () => {
   })
 })
 
-/** Admits clean files only, as Chat's gate does for a match oracle (an opaque view). */
+/** A clipped preview cannot reliably redact a value split by the index. */
 const cleanOnlyGate: ContentDeliveryGate = {
   async admit(sources) {
     return sources.map(
@@ -125,10 +124,10 @@ describe('searchWorkspaceFileContent for Chat', () => {
     )
   })
 
-  it('keeps refused matches from taking the place of admitted ones', async () => {
+  it('preserves match locations while withholding unreadable previews', async () => {
     mocks.search.mockResolvedValue({
-      results: [hit('refused', 1), hit('refused', 2), hit('clean', 3), hit('clean', 4)],
-      count: 4,
+      results: [hit('refused', 1), hit('clean', 3)],
+      count: 2,
       truncated: false,
       complete: true,
       indexStatus: 'ready',
@@ -140,13 +139,15 @@ describe('searchWorkspaceFileContent for Chat', () => {
         input: { ...input, maxResults: 2 },
       })
     )
-    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(FILE_SEARCH_MAX_RESULTS)
-    expect(found.results.map((result) => result.lineNumber)).toEqual([3, 4])
+    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(2)
+    expect(found.results.map((result) => result.lineNumber)).toEqual([1, 3])
+    expect(found.results[0].text).toMatch(/preview withheld/i)
+    expect(found.results[1].text).toBe('needle 3')
     expect(found).toMatchObject({ count: 2, truncated: false })
     expect(found.sources.map((entry) => entry.identity.fileId)).toEqual(['clean'])
   })
 
-  it('does not signal more matches when only refused files matched', async () => {
+  it('keeps truthful truncation when a page contains only unreadable previews', async () => {
     mocks.search.mockResolvedValue({
       results: [hit('refused', 1)],
       count: 1,
@@ -161,25 +162,9 @@ describe('searchWorkspaceFileContent for Chat', () => {
         input: { ...input, maxResults: 1 },
       })
     )
-    expect(found).toMatchObject({ results: [], count: 0, truncated: false })
-  })
-
-  it("reports truncation from admitted matches past the caller's limit", async () => {
-    mocks.search.mockResolvedValue({
-      results: [hit('clean', 1), hit('clean', 2), hit('clean', 3)],
-      count: 3,
-      truncated: false,
-      complete: true,
-      indexStatus: 'ready',
-      sources: [source('clean')],
-    })
-    const found = await observeContentDelivery(cleanOnlyGate, () =>
-      searchWorkspaceFileContent.execute({
-        principal: copilotPrincipal(),
-        input: { ...input, maxResults: 2 },
-      })
-    )
-    expect(found).toMatchObject({ count: 2, truncated: true })
+    expect(found).toMatchObject({ count: 1, truncated: true })
+    expect(found.results[0]).toMatchObject({ fileId: 'refused', lineNumber: 1 })
+    expect(found.results[0].text).toMatch(/preview withheld/i)
   })
 
   it("leaves a person's search limit and result untouched", async () => {
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index 872b120bb1a..bb41f5f6625 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -5,7 +5,6 @@ import { admitWorkspaceFileIdentities } from '@/lib/workspace-files/application/
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveWorkspaceFolderScope } from '@/lib/workspace-files/resolve-folder-scope'
-import { FILE_SEARCH_MAX_RESULTS } from '@/lib/workspace-files/search/constants'
 import { WorkspaceFileSearchUnavailableError } from '@/lib/workspace-files/search/errors'
 import {
   compileFileSearchPattern,
@@ -64,23 +63,15 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     signal?.throwIfAborted()
 
     try {
-      /**
-       * Chat drops matches from files it may not read, so it fetches the most the index returns
-       * and keeps its own limit afterwards: refused matches never take an admitted match's place.
-       */
       const classified = isCopilotPrincipal(principal)
       const found = await searchWorkspaceFileIndex({
         workspaceId: context.workspaceId,
         pattern: compileFileSearchPattern(input.query, input.mode),
-        maxResults: classified ? FILE_SEARCH_MAX_RESULTS : input.maxResults,
+        maxResults: input.maxResults,
         folderScope,
         signal,
       })
-      /**
-       * A match is evaluated against a file's raw indexed text, so a hit in a file holding a
-       * recorded secret answers a question about that secret whatever its preview shows. Such a
-       * file's lines are therefore withheld like an unknown file's; grep matches redacted text.
-       */
+      /** Index previews are already clipped; protect them without changing match locations or totals. */
       const admitted = await admitWorkspaceFileIdentities(
         principal,
         context.workspaceId,
@@ -88,19 +79,16 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
         'opaque'
       )
       if (!classified) return found
-      const matches = found.results.filter((result) => admitted.has(result.fileId))
-      const results = matches.slice(0, input.maxResults)
       return {
         ...found,
-        results,
-        count: results.length,
-        /**
-         * Derived from admitted matches only, so a refused match is never signalled. Matches past
-         * the index's own cap are unknown; they are reported only when this page is full anyway.
-         */
-        truncated:
-          matches.length > input.maxResults ||
-          (found.truncated && matches.length >= input.maxResults),
+        results: found.results.map((result) =>
+          admitted.has(result.fileId)
+            ? result
+            : {
+                ...result,
+                text: '[Preview withheld: read or grep this file to inspect protected text.]',
+              }
+        ),
         sources: found.sources.filter((source) => admitted.has(source.identity.fileId)),
       }
     } catch (error) {
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index a00074a0cf0..32360f8e6cd 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -1536,14 +1536,6 @@ async function consumePrivateToolResponseMetadata(
   }
 }
 
-/**
- * Whether a tool's result carries secret provenance its caller must project: it reads stored
- * content (workspace files, knowledge, tables, memory), runs code, or calls an MCP server.
- */
-export function toolResultCarriesSecretProvenance(toolId: string): boolean {
-  return getPrivateToolMetadataPolicy(toolId) !== undefined
-}
-
 function getPrivateToolMetadataPolicy(toolId: string): PrivateToolMetadataPolicy | undefined {
   const normalizedToolId = normalizeToolId(toolId)
   if (normalizedToolId === 'file_get_content' || isMcpTool(normalizedToolId)) {
diff --git a/packages/testing/src/mocks/tools.mock.ts b/packages/testing/src/mocks/tools.mock.ts
index f4c3c370b9b..5c3186b3675 100644
--- a/packages/testing/src/mocks/tools.mock.ts
+++ b/packages/testing/src/mocks/tools.mock.ts
@@ -36,8 +36,6 @@ export const toolsMockFns = {
   mockExecuteTool: vi.fn(),
   /** Defaults to the real `__`-field stripping semantics. */
   mockPostProcessToolOutput: vi.fn(postProcessToolOutput),
-  /** Defaults to `false`: no tool's result carries provenance until a test says so. */
-  mockToolResultCarriesSecretProvenance: vi.fn((_toolId: string) => false),
 }
 
 /**
@@ -51,5 +49,4 @@ export const toolsMockFns = {
 export const toolsMock = {
   executeTool: toolsMockFns.mockExecuteTool,
   postProcessToolOutput: toolsMockFns.mockPostProcessToolOutput,
-  toolResultCarriesSecretProvenance: toolsMockFns.mockToolResultCarriesSecretProvenance,
 }
diff --git a/scripts/check-test-types.baseline.json b/scripts/check-test-types.baseline.json
index b54a1d20dfb..d02c47ddb80 100644
--- a/scripts/check-test-types.baseline.json
+++ b/scripts/check-test-types.baseline.json
@@ -994,9 +994,6 @@
   "apps/sim/lib/api/list-keyset-paging.test.ts": {
     "TS2554": 4
   },
-  "apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts": {
-    "TS2322": 1
-  },
   "apps/sim/lib/api/server/routes/definition.test.ts": {
     "TS2741": 1
   },
@@ -1683,9 +1680,6 @@
   "apps/sim/lib/knowledge/application/slack-search/stop.test.ts": {
     "TS2352": 2
   },
-  "apps/sim/lib/knowledge/application/tags.test.ts": {
-    "TS2322": 2
-  },
   "apps/sim/lib/knowledge/chunks/keyset-sql.test.ts": {
     "TS2345": 2
   },
@@ -1967,10 +1961,6 @@
     "TS2345": 1,
     "TS2550": 2
   },
-  "apps/sim/lib/mothership/chat/process-contents.test.ts": {
-    "TS2322": 6,
-    "TS2345": 1
-  },
   "apps/sim/lib/mothership/chat/terminal-state.test.ts": {
     "TS18046": 2,
     "TS2571": 1
@@ -2167,10 +2157,7 @@
   },
   "apps/sim/lib/table/application/rows.test.ts": {
     "TS2322": 4,
-    "TS2345": 1,
-    "TS2352": 1,
     "TS2353": 2,
-    "TS2493": 1,
     "TS2739": 5,
     "TS2741": 1
   },
@@ -2520,9 +2507,6 @@
   "apps/sim/lib/workspace-events/rules.test.ts": {
     "TS2353": 1
   },
-  "apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts": {
-    "TS2345": 1
-  },
   "apps/sim/lib/workspace-files/application/edit-workspace-file-content.test.ts": {
     "TS2345": 1,
     "TS2741": 1

From 9b1a95d7d66dfec0a4b7b5b81d64d9ada8846cba Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 15:15:54 -0700
Subject: [PATCH 07/13] fix(mothership): preserve protection across content
 transformations

---
 .claude/rules/sim-content-delivery.md         |   9 +-
 .cursor/rules/sim-content-delivery.mdc        |   9 +-
 .../lib/core/application/content-delivery.ts  |  22 ++-
 .../content-reads.integration.ts              | 110 ++++++++++-
 .../content-delivery.integration.ts           |  60 ++++++
 ...xecution-archive-provenance.integration.ts | 142 +++++++++++++-
 apps/sim/lib/knowledge/application/exports.ts |   4 +-
 .../knowledge/documents/document-processor.ts |   9 +-
 .../documents/ocr-checkpoints.test.ts         |   3 +-
 .../lib/knowledge/model-input-provenance.ts   |   6 +-
 apps/sim/lib/knowledge/secret-provenance.ts   |  67 ++++---
 .../lib/media/ffmpeg-content.integration.ts   |  28 +++
 .../content-delivery.integration.ts           | 184 +++++++++++++++++-
 .../agent-cli/engines/observe-private-file.ts |   2 +-
 .../content-delivery/registry-gate.test.ts    |   7 +-
 .../content-delivery/registry-gate.ts         |   6 +-
 .../content-delivery/session-gate.ts          |  31 +++
 .../tools/server/files/doc-compile.ts         |  11 +-
 .../tools/server/files/workspace-file.ts      |   6 +-
 .../read-workspace-file-content.ts            |  19 +-
 .../application/read-workspace-file-text.ts   |   4 +-
 .../search-workspace-file-content.ts          |   2 +-
 22 files changed, 663 insertions(+), 78 deletions(-)

diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
index e9dc5888411..6d976d8471d 100644
--- a/.claude/rules/sim-content-delivery.md
+++ b/.claude/rules/sim-content-delivery.md
@@ -37,8 +37,13 @@ the workflow executor see byte-identical results.
     does not undo the write: audit and effects run, then the operation answers with the refusal.
     Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
-    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
-    redaction reaches: binary, base64, archives, images, public links).
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
   them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
index fc8405caab3..4e1b90df027 100644
--- a/.cursor/rules/sim-content-delivery.mdc
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -28,8 +28,13 @@ the workflow executor see byte-identical results.
     does not undo the write: audit and effects run, then the operation answers with the refusal.
     Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
-    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
-    redaction reaches: binary, base64, archives, images, public links).
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
   them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
index ece0901599e..d07902baf2a 100644
--- a/apps/sim/lib/core/application/content-delivery.ts
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -23,9 +23,10 @@ export type ContentSourceKind =
 /**
  * How an item's content leaves the use case. `complete` is text in which any of its secrets may
  * appear; `derived` is text built from part of it, so only secrets occurring in `value` count;
- * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links.
+ * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links;
+ * `excerpt` is text already cut before admission, so a secret fragment cannot be redacted.
  */
-export type ContentView = 'complete' | 'opaque' | { derived: unknown }
+export type ContentView = 'complete' | 'opaque' | 'excerpt' | { derived: unknown }
 
 /** One stored item or tool result whose content a use case is about to return. */
 export interface ContentSource {
@@ -43,10 +44,13 @@ export interface ContentSource {
 export interface ContentDeliveryGate {
   admit(sources: readonly ContentSource[]): Promise<readonly boolean[]>
   /**
-   * The text as this surface's egress will show it, or `undefined` when it cannot be shown. A gate
-   * whose surface redacts (Chat's registry) implements it; see {@link redactBeforeCutting}.
+   * Redacts text before cutting, or returns `undefined` when it cannot be shown. The current
+   * operation's bounded evidence lets a surface create a redactor only when a cut needs one.
    */
-  project?(text: string): string | undefined
+  project?(
+    text: string,
+    provenance?: ContentProvenance
+  ): string | undefined | Promise<string | undefined>
 }
 
 /**
@@ -149,17 +153,17 @@ export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: ()
 /**
  * Text a use case is about to cut (a line window, a clip), redacted first by the surface's gate.
  * Egress redacts whole secrets only, so a cut through one would leave a fragment it cannot
- * recognize. Other callers, and surfaces that do not redact, get the text unchanged.
+ * recognize. Other callers and explicit outside-model reads get the text unchanged.
  */
-export function redactBeforeCutting(
+export async function redactBeforeCutting(
   principal: Principal | undefined,
   text: string,
   kind: ContentSourceKind
-): string {
+): Promise<string> {
   if (principal && !isCopilotPrincipal(principal)) return text
   const project = gates.getStore()?.project
   if (!project) return text
-  const projected = project(text)
+  const projected = await project(text, ledgers.getStore()?.admitted[0])
   if (projected === undefined) throw new ContentRefusedError(kind)
   return projected
 }
diff --git a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
index 813685f3233..15653546417 100644
--- a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
+++ b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
@@ -1,10 +1,10 @@
 import { execFile } from 'node:child_process'
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import { db } from '@sim/db'
-import { auditLog, organization, user, workspace } from '@sim/db/schema'
+import { auditLog, organization, user, workspace, workspaceFiles } from '@sim/db/schema'
 import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { toolsMock, toolsMockFns } from '@sim/testing/mocks/tools.mock'
 import { generateId } from '@sim/utils/id'
@@ -29,6 +29,7 @@ import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-deleg
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { executeFunctionExecute } from '@/lib/mothership/tools/handlers/function-execute'
 import { compileDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { compileDocForWrite } from '@/lib/mothership/tools/server/files/workspace-file'
 import {
   updateWorkspaceFileContent,
   uploadWorkspaceFile,
@@ -179,6 +180,111 @@ describe('Chat admits the file revision used by a sandbox', () => {
     expect(projected.value).toContain('{{BROKER_TOKEN}}')
   }, 60_000)
 
+  it('admits broker inputs during legacy document-write validation before returning compiler errors', async () => {
+    const principal = createCopilotChatFilePrincipal({
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      chatId,
+    })
+    const validate = (source: string, trace: ResolvedSecretTraceRegistry) =>
+      observeContentDelivery(
+        createRegistryContentGate({
+          registry: trace,
+          workspaceId: ids.workspaceId,
+          actorUserId: ids.aliceId,
+        }),
+        () =>
+          compileDocForWrite({
+            source,
+            fileName: 'write-validation.pdf',
+            workspaceId: ids.workspaceId,
+            principal,
+            ownerKey: `user:${ids.aliceId}`,
+            fallbackMime: 'application/pdf',
+          })
+      )
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified input'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    const refused = await validate(
+      `const id = ${JSON.stringify(fileId)}; await getFileBase64(id); pdf.addPage();`,
+      registry()
+    )
+    expect.soft(refused).toMatchObject({ ok: false })
+    if (!refused.ok) expect(refused.message).toMatch(/provenance|read safely/i)
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from(secret),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: {
+          mode: 'replace',
+          provenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'BROKER_TOKEN',
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+              },
+            ],
+          },
+        },
+      }
+    )
+    const trace = registry()
+    const failed = await validate(
+      `const id = ${JSON.stringify(fileId)}; const uri = await getFileBase64(id); throw new Error(Buffer.from(uri.split(',')[1], 'base64').toString());`,
+      trace
+    )
+    expect(failed.ok).toBe(false)
+    if (failed.ok) throw new Error('Expected the document source to fail')
+    expect(failed.message).toContain(secret)
+    const projected = projectResolvedSecretModelContent(failed.message, trace)
+    if (!projected.safe) throw new Error('Expected a safely projected compiler error')
+    expect(projected.value).not.toContain(secret)
+    expect(projected.value).toContain('{{BROKER_TOKEN}}')
+  }, 60_000)
+
+  it('keeps successful legacy dynamic-input documents readable after their first compile', async () => {
+    const references = Array.from({ length: 501 }, (_, index) => ({
+      id: `wf_${generateId()}`,
+      key: `workspace/${ids.workspaceId}/cache-reference-${generateId()}.txt`,
+      originalName: `reference-${index}.txt`,
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      context: 'workspace',
+      contentType: 'text/plain',
+      sizeBytes: 6,
+    }))
+    await db.insert(workspaceFiles).values(references)
+    await mkdir(join(storage.root, 'workspace', ids.workspaceId), { recursive: true })
+    for (const reference of references) {
+      await writeFile(join(storage.root, reference.key), 'public')
+    }
+    const source = `const ids = ${JSON.stringify(references.map((file) => file.id))}; for (const id of ids) await getFileBase64(id); pdf.addPage().drawText('compiled all references');`
+    const first = await compile(source, registry())
+    expect(first.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(first.contributingFiles).toHaveLength(references.length)
+    const second = await compile(source, registry())
+    expect(second.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(second.contributingFiles).toHaveLength(references.length)
+  }, 120_000)
+
   it('does not run code with a stale local file after refusing its requested replacement', async () => {
     await updateWorkspaceFileContent(
       ids.workspaceId,
diff --git a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
index 7c8ebc6d217..360258ab08b 100644
--- a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
@@ -273,6 +273,66 @@ describe('knowledge content delivery', () => {
     }
   })
 
+  it('streams chunk pages without reloading the tracked inline original for each page', async () => {
+    const content = 'inline original content '.repeat(4096)
+    const doc = await seedDocument({ content, provenance: { status: 'exact', entries: [] } })
+    await db.insert(embedding).values(
+      Array.from({ length: 100 }, (_, index) => {
+        const text = `public exported chunk ${index + 1}`
+        return {
+          id: generateId(),
+          documentId: doc.id,
+          knowledgeBaseId: ids.knowledgeBaseId,
+          chunkIndex: index + 1,
+          ...embeddingVectorValues(1536, [1, ...Array<number>(1535).fill(0)]),
+          chunkHash: sha256Hex(text),
+          content: text,
+          contentLength: text.length,
+          tokenCount: 4,
+          startOffset: 0,
+          endOffset: text.length,
+          tag1: 'public',
+        }
+      })
+    )
+    const bundle = await inChat(() =>
+      exportKnowledgeBase.execute({
+        principal,
+        input: { knowledgeBaseId: ids.knowledgeBaseId, vectors: true },
+      })
+    )
+    const originalBytes = Buffer.byteLength(
+      `data:text/plain;base64,${Buffer.from(content).toString('base64')}`
+    )
+    let loadedOriginalBytes = 0
+    const execute = PostgresJsPreparedQuery.prototype.execute
+    const measure = vi
+      .spyOn(PostgresJsPreparedQuery.prototype, 'execute')
+      .mockImplementation(async function (this: typeof PostgresJsPreparedQuery.prototype, values) {
+        const rows = await execute.call(this, values)
+        if (Array.isArray(rows)) {
+          for (const row of rows) {
+            if (!isRecordLike(row)) continue
+            const value = row.fileUrl
+            if (typeof value === 'string' && value.startsWith('data:'))
+              loadedOriginalBytes += Buffer.byteLength(value)
+          }
+        }
+        return rows
+      })
+    try {
+      const exported: string[] = []
+      for await (const chunk of bundle.chunks(doc.id)) exported.push(chunk.content)
+      expect(exported).toHaveLength(101)
+      expect(exported[0]).toBe(content)
+      expect(exported.at(-1)).toBe('public exported chunk 100')
+      expect(loadedOriginalBytes).toBeGreaterThan(0)
+      expect(loadedOriginalBytes).toBeLessThanOrEqual(originalBytes)
+    } finally {
+      measure.mockRestore()
+    }
+  })
+
   it('keeps stored search totals and continuation while withholding only unsafe documents', async () => {
     await seedDocument({ name: 'page-a.txt' })
     await seedDocument({ name: 'page-b.txt', provenance: { status: 'unknown' } })
diff --git a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
index 137e80f244b..ef4502e145d 100644
--- a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
@@ -24,6 +24,7 @@ import JSZip from 'jszip'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 
 const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+const embeddingInputs = vi.hoisted(() => new Map<string, string[]>())
 const sandboxEnvironment = vi.hoisted(() => {
   const fixture = {
     SANDBOX_PROVIDER: 'e2b',
@@ -45,18 +46,26 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
 vi.mock('@/lib/embeddings', async () => ({
   ...(await import('@/lib/embeddings/client')),
   assertKnowledgeEmbeddingCapacity: async () => {},
-  embedKnowledge: async (texts: string[]) => ({
-    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
-    totalTokens: texts.length,
-    billableTokens: 0,
-    isBYOK: true,
-    modelName: 'text-embedding-3-small',
-    pricingId: 'text-embedding-3-small',
-  }),
+  embedKnowledge: async (texts: string[], options: { workspaceId?: string | null }) => {
+    if (options.workspaceId) {
+      const inputs = embeddingInputs.get(options.workspaceId) ?? []
+      inputs.push(...texts)
+      embeddingInputs.set(options.workspaceId, inputs)
+    }
+    return {
+      embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+      totalTokens: texts.length,
+      billableTokens: 0,
+      isBYOK: true,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    }
+  },
 }))
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import { fileManageDecompressBodySchema } from '@/lib/api/contracts/tools/file'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { processOutboxEventById } from '@/lib/core/outbox/service'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { isUserFile } from '@/lib/core/utils/user-file'
@@ -76,16 +85,20 @@ import {
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { addWorkspaceFilesToKnowledgeBase } from '@/lib/knowledge/application/add-workspace-files'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
 import { searchKnowledge } from '@/lib/knowledge/application/search'
 import { KNOWLEDGE_DOCUMENT_PROCESSING_OUTBOX_EVENT } from '@/lib/knowledge/documents/processing-events'
 import { knowledgeDocumentProcessingOutboxHandlers } from '@/lib/knowledge/documents/processing-outbox-handler'
 import { createSingleDocument } from '@/lib/knowledge/documents/service'
 import { loadKnowledgeDocumentSecretRegistry } from '@/lib/knowledge/secret-provenance'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution/execution-file-manager'
 import {
   deleteWorkspaceFile,
   getWorkspaceFile,
+  uploadWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
   filterModelSafeWorkspaceFileAttachments,
@@ -715,6 +728,119 @@ describe('Function export provenance in PostgreSQL', () => {
 })
 
 describe('execution archive durable provenance', () => {
+  it.each([
+    {
+      name: 'whitespace-normalized secret',
+      secret: '  fixture-live-key-82367  ',
+      fragments: ['fixture-live-key-82367'],
+      masked: true,
+    },
+    {
+      name: 'secret crossing chunk boundaries',
+      secret: `left-fixture-secret-${'Q'.repeat(180)}-right-fixture-secret`,
+      fragments: ['left-fixture-secret', 'QQQQQQQQ', 'right-fixture-secret'],
+      masked: true,
+    },
+    { name: 'short secret cutoff', secret: 'T0k3n42', fragments: [], masked: false },
+  ])(
+    'indexes $name without changing original bytes or exposing derived fragments',
+    async (testCase) => {
+      const ids = await seed()
+      await db
+        .update(knowledgeBase)
+        .set({ chunkingConfig: { maxSize: 32, minSize: 1, overlap: 0 } })
+        .where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+      const { encrypted } = await encryptSecret(testCase.secret)
+      const content = `Public introduction.\n${testCase.secret}\nPublic conclusion.`
+      const source = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(content),
+        'source.txt',
+        'text/plain',
+        {
+          notifyWorkspaceChange: false,
+          secretProvenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'FIXTURE_SECRET',
+                encryptedValue: encrypted,
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+              },
+            ],
+          },
+        }
+      )
+      const imported = await addWorkspaceFilesToKnowledgeBase.execute({
+        principal: sessionPrincipal(ids),
+        input: { knowledgeBaseId: ids.knowledgeBaseId, fileReferences: [source.id] },
+      })
+      expect(imported.failed).toEqual([])
+      expect(imported.added).toHaveLength(1)
+      const documentId = imported.added[0].documentId
+      const events = await db
+        .select()
+        .from(outboxEvent)
+        .where(sql`${outboxEvent.payload}::jsonb ->> 'documentId' = ${documentId}`)
+      trackedEventIds.push(...events.map((event) => event.id))
+      const dispatch = events.find(
+        (event) => event.eventType === KNOWLEDGE_DOCUMENT_PROCESSING_OUTBOX_EVENT
+      )
+      if (!dispatch) throw new Error('Knowledge import did not queue document processing')
+      await processOutboxEventById(dispatch.id, knowledgeDocumentProcessingOutboxHandlers)
+      const [indexed] = await db.select().from(document).where(eq(document.id, documentId))
+      expect(indexed.processingStatus, indexed.processingError ?? undefined).toBe('completed')
+      if (!indexed.storageKey) throw new Error('Knowledge import did not retain its original')
+      expect(
+        (await downloadFile({ key: indexed.storageKey, context: 'knowledge-base' })).toString()
+      ).toBe(content)
+      const stored = await listKnowledgeChunks.execute({
+        principal: sessionPrincipal(ids),
+        input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+      })
+      const readbackRegistry = new ResolvedSecretTraceRegistry([], {
+        userId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      const gate = createRegistryContentGate({
+        registry: readbackRegistry,
+        actorUserId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      const readback = await observeContentDelivery(gate, () =>
+        listKnowledgeChunks.execute({
+          principal: createCopilotChatPrincipal(
+            { userId: ids.aliceId, workspaceId: ids.workspaceId },
+            KNOWLEDGE_DELEGATION_AUDIENCE
+          ),
+          input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+        })
+      )
+      expect(readback.chunks.length).toBeGreaterThan(0)
+      const projected = projectResolvedSecretModelContent(readback, readbackRegistry)
+      expect(projected.safe).toBe(true)
+      if (!projected.safe) throw new Error('Indexed chunk readback was withheld')
+      const outputs = [
+        (embeddingInputs.get(ids.workspaceId) ?? []).join('\n'),
+        stored.chunks.map((chunk) => chunk.content).join('\n'),
+        JSON.stringify(projected.value),
+      ]
+      for (const output of outputs) {
+        expect(output).toContain('Public introduction.')
+        expect(output).toContain('Public conclusion.')
+        if (testCase.masked) {
+          expect(output).toContain('{{FIXTURE_SECRET}}')
+          for (const fragment of testCase.fragments) expect(output).not.toContain(fragment)
+        } else {
+          expect(output).toContain(testCase.secret)
+          expect(output).not.toContain('{{FIXTURE_SECRET}}')
+        }
+      }
+    }
+  )
+
   it.each(['exact', 'unrecorded'] as const)(
     'carries %s lineage through extraction and delayed KB indexing/search',
     async (status) => {
diff --git a/apps/sim/lib/knowledge/application/exports.ts b/apps/sim/lib/knowledge/application/exports.ts
index f1d91b49fe0..c562b16471e 100644
--- a/apps/sim/lib/knowledge/application/exports.ts
+++ b/apps/sim/lib/knowledge/application/exports.ts
@@ -14,7 +14,7 @@ import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { KNOWLEDGE_BUNDLE_VERSION } from '@/lib/knowledge/constants'
 import { toKbEmbeddingDimensions } from '@/lib/knowledge/embedding-models'
 import {
-  classifyKnowledgeChunks,
+  classifyKnowledgeChunkContent,
   classifyKnowledgeDocumentMetadata,
   loadKnowledgeDocumentDurableSecretProvenance,
 } from '@/lib/knowledge/secret-provenance'
@@ -151,7 +151,7 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
           classify
             ? (page) =>
                 inExportContext(async () => {
-                  const provenance = await classifyKnowledgeChunks(
+                  const provenance = await classifyKnowledgeChunkContent(
                     page.map((chunk) => ({ ...chunk, documentId }))
                   )
                   const sources = page.map((chunk) => ({
diff --git a/apps/sim/lib/knowledge/documents/document-processor.ts b/apps/sim/lib/knowledge/documents/document-processor.ts
index eacda690ff2..94546645e74 100644
--- a/apps/sim/lib/knowledge/documents/document-processor.ts
+++ b/apps/sim/lib/knowledge/documents/document-processor.ts
@@ -79,6 +79,7 @@ import type { VisionExtractionUsage } from '@/lib/knowledge/documents/vision-che
 import {
   assertKnowledgeOpaqueModelInputSafe,
   getKnowledgeOpaqueModelInputRegistry,
+  projectKnowledgeModelInput,
 } from '@/lib/knowledge/model-input-provenance'
 import { getFileExtension, isInternalFileUrl } from '@/lib/uploads/utils/file-utils'
 import {
@@ -305,7 +306,7 @@ export async function processDocument(
       ? { content: image.renderedText, processingMethod: 'vision-extract' }
       : await parseDocument(fileUrl, filename, mimeType, access, workspaceId)
     access.signal?.throwIfAborted()
-    const { content, processingMethod, cloudUrl } = parseResult
+    const { content: parsedContent, processingMethod, cloudUrl } = parseResult
     if (parseResult.metadata?.detectedType || parseResult.metadata?.warning) {
       logger.info('Parser reported a warning for the document', {
         filename,
@@ -320,13 +321,15 @@ export async function processDocument(
      * document that reports success while holding nothing. Failing here keeps it
      * visible with a reason instead.
      */
-    if (parseResult.metadata?.degraded || !content.trim()) {
+    if (parseResult.metadata?.degraded || !parsedContent.trim()) {
       throw new PermanentDocumentProcessingError(
         'no_extractable_text',
         unreadableDocumentMessage(filename)
       )
     }
 
+    // Chunkers transform text; source and parser budgets already bound this materialized input.
+    const content = projectKnowledgeModelInput(parsedContent, Number.POSITIVE_INFINITY)
     let chunks: Chunk[]
     const metadata: FileParseMetadata = parseResult.metadata ?? {}
 
@@ -398,7 +401,7 @@ export async function processDocument(
     }
 
     access.signal?.throwIfAborted()
-    const characterCount = content.length
+    const characterCount = parsedContent.length
     const tokenCount = chunks.reduce((sum, chunk) => sum + chunk.tokenCount, 0)
 
     logger.info(`Document processed: ${chunks.length} chunks, ${tokenCount} tokens`)
diff --git a/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts b/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
index 9eddddb08ab..43498f3d722 100644
--- a/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
+++ b/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
@@ -12,7 +12,8 @@ const hoisted = vi.hoisted(() => ({
   executeOcr: vi.fn(),
 }))
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
-vi.mock('@/lib/knowledge/model-input-provenance', () => ({
+vi.mock(import('@/lib/knowledge/model-input-provenance'), async (importOriginal) => ({
+  ...(await importOriginal()),
   getKnowledgeOpaqueModelInputRegistry: hoisted.provenance,
   assertKnowledgeOpaqueModelInputSafe: hoisted.provenance,
 }))
diff --git a/apps/sim/lib/knowledge/model-input-provenance.ts b/apps/sim/lib/knowledge/model-input-provenance.ts
index bf15f898be2..fa0a169dd16 100644
--- a/apps/sim/lib/knowledge/model-input-provenance.ts
+++ b/apps/sim/lib/knowledge/model-input-provenance.ts
@@ -116,12 +116,12 @@ export function getKnowledgeOpaqueModelInputRegistry(): ResolvedSecretTraceRegis
   return context.registry ?? new ResolvedSecretTraceRegistry()
 }
 
-/** Projects one string immediately before it enters an embedding or reranking request. */
-export function projectKnowledgeModelInput(value: string): string {
+/** Projects known literals in text before its transformation or delivery to a model. */
+export function projectKnowledgeModelInput(value: string, maxBytes?: number): string {
   const registry = knowledgeModelInputContext.getStore()?.registry
   if (!registry) return value
 
-  const projection = projectResolvedSecretModelContent(value, registry)
+  const projection = projectResolvedSecretModelContent(value, registry, maxBytes)
   if (!projection.safe || typeof projection.value !== 'string') {
     refuseResolvedSecretProjection({
       site: 'knowledge.modelInput',
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index e882b3cd610..60cf942f339 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -556,19 +556,40 @@ export async function classifyKnowledgeDocumentMetadata(
   return result
 }
 
+interface KnowledgeChunkContentSnapshot {
+  id: string
+  documentId: string
+  content: string
+}
+
+/** Classifies chunk bytes against their current stored identity and content binding. */
+export async function classifyKnowledgeChunkContent(
+  chunks: readonly KnowledgeChunkContentSnapshot[]
+): Promise<Map<string, DurableSecretProvenance>> {
+  const ids = [...new Set(chunks.map((chunk) => chunk.id))]
+  const rows = ids.length
+    ? await selectKnowledgeEmbeddingProvenanceRows(inArray(embedding.id, ids))
+    : []
+  const rowById = new Map(rows.map((row) => [row.id, row]))
+  return new Map(
+    chunks.map((chunk): [string, DurableSecretProvenance] => {
+      const row = rowById.get(chunk.id)
+      return [
+        chunk.id,
+        !row || row.documentId !== chunk.documentId || row.content !== chunk.content
+          ? { status: 'unknown' }
+          : readBoundKnowledgeEmbeddingSecretProvenance(row),
+      ]
+    })
+  )
+}
+
 /**
- * Classifies each chunk a result returns: its own content's binding, merged with the metadata of
- * the document whose tags the chunk carries. A chunk whose row moved since it was read (other
- * document, other content) reads as unknown. Chunk rows and document metadata are batched;
- * tracked inline document sources are loaded individually to verify their bindings.
+ * Classifies a result's chunk bytes and the document metadata it displays. Both are bound to
+ * the returned snapshots; tracked inline originals are loaded individually for metadata bindings.
  */
 export async function classifyKnowledgeChunks(
-  chunks: readonly {
-    id: string
-    documentId: string
-    content: string
-    snapshot?: KnowledgeDocumentSnapshot
-  }[]
+  chunks: readonly (KnowledgeChunkContentSnapshot & { snapshot?: KnowledgeDocumentSnapshot })[]
 ): Promise<Map<string, DurableSecretProvenance>> {
   const snapshots = new Map<string, KnowledgeDocumentSnapshot[]>()
   for (const chunk of chunks) {
@@ -578,29 +599,21 @@ export async function classifyKnowledgeChunks(
       else snapshots.set(chunk.documentId, [chunk.snapshot])
     }
   }
-  const ids = [...new Set(chunks.map((chunk) => chunk.id))]
-  const [rows, documents] = await Promise.all([
-    ids.length ? selectKnowledgeEmbeddingProvenanceRows(inArray(embedding.id, ids)) : [],
+  const [contents, documents] = await Promise.all([
+    classifyKnowledgeChunkContent(chunks),
     classifyKnowledgeDocumentMetadata(
       chunks.map((chunk) => chunk.documentId),
       snapshots
     ),
   ])
-  const rowById = new Map(rows.map((row) => [row.id, row]))
   return new Map(
-    chunks.map((chunk): [string, DurableSecretProvenance] => {
-      const row = rowById.get(chunk.id)
-      if (!row || row.documentId !== chunk.documentId || row.content !== chunk.content) {
-        return [chunk.id, { status: 'unknown' }]
-      }
-      return [
-        chunk.id,
-        mergeDurableSecretProvenance(
-          readBoundKnowledgeEmbeddingSecretProvenance(row),
-          documents.get(chunk.documentId) ?? { status: 'unknown' }
-        ),
-      ]
-    })
+    chunks.map((chunk): [string, DurableSecretProvenance] => [
+      chunk.id,
+      mergeDurableSecretProvenance(
+        contents.get(chunk.id) ?? { status: 'unknown' },
+        documents.get(chunk.documentId) ?? { status: 'unknown' }
+      ),
+    ])
   )
 }
 
diff --git a/apps/sim/lib/media/ffmpeg-content.integration.ts b/apps/sim/lib/media/ffmpeg-content.integration.ts
index 8b3a119f0f6..e9b46fe7c8c 100644
--- a/apps/sim/lib/media/ffmpeg-content.integration.ts
+++ b/apps/sim/lib/media/ffmpeg-content.integration.ts
@@ -10,12 +10,15 @@ import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { generateId } from '@sim/utils/id'
 import { eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import type { FfmpegOperation, MediaFile } from '@/lib/media/ffmpeg'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { ffmpegServerTool } from '@/lib/mothership/tools/server/media/ffmpeg'
 import * as workspaceReader from '@/lib/uploads/contexts/workspace'
 import {
@@ -28,6 +31,7 @@ import {
   getBoundWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -145,6 +149,30 @@ describe('media input version lineage', () => {
       expect(result.success).toBe(false)
       expect(result.message).not.toContain(SECRET)
       expect(result.message).not.toContain(storage.root)
+      await expect(
+        observeContentDelivery(
+          createRegistryContentGate({
+            registry: new ResolvedSecretTraceRegistry([], {
+              userId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+            actorUserId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+          }),
+          () =>
+            readWorkspaceFileContent.execute({
+              principal: createCopilotChatPrincipal(
+                { userId: ids.aliceId, workspaceId: ids.workspaceId },
+                WORKSPACE_FILES_DELEGATION_AUDIENCE
+              ),
+              input: { fileId: file.id },
+            })
+        )
+      ).rejects.toThrow(
+        classification === 'known'
+          ? 'File content could not be read'
+          : 'File cannot be sent to a model because its secret provenance is unavailable'
+      )
       await expect(
         readWorkspaceFileContent.execute({
           principal: { kind: 'session', userId: ids.aliceId, sessionId: generateId() },
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 7d0fc2225a1..0f2722b0e6c 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -68,7 +68,11 @@ vi.mock('@/lib/internal/tool-operations/registry.server', async (importOriginal)
 })
 
 import { db } from '@sim/db'
-import { copilotChats, userTableRowSecretProvenance } from '@sim/db/schema'
+import {
+  copilotChats,
+  userTableRowSecretProvenance,
+  workspaceFileSearchRevision,
+} from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
 import { eq, sql } from 'drizzle-orm'
 import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
@@ -87,6 +91,7 @@ import {
 import {
   CANARY,
   type ContentFixture,
+  callV2,
   ORIGIN,
   removeContentFixture,
   seedContentFixture,
@@ -96,6 +101,8 @@ import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
 import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -767,6 +774,176 @@ describe('content reaching Chat is admitted per item', () => {
     })
   })
 
+  describe.each(['cli', 'sandbox'] as const)('%s text excerpts', (surface) => {
+    const read = (route: string) => (surface === 'cli' ? cli('GET', route) : sandbox('GET', route))
+
+    it('preserves indexed match locations without releasing a clipped secret prefix', async () => {
+      const query = `preview-cut-${generateId()}`
+      const provenance: WorkspaceFileSecretProvenance = {
+        status: 'exact',
+        entries: [
+          {
+            encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+            sourceUserId: fixture.ids.aliceId,
+            sourceWorkspaceId: ws(),
+            name: 'FIXTURE_TOKEN',
+          },
+        ],
+      }
+      const sources = [
+        {
+          name: 'protected',
+          content: `${`${query} `.padEnd(500, '.')}${CANARY.secret} after the token`,
+          provenance,
+        },
+        {
+          name: 'clean',
+          content: `${query} clean preview`,
+          provenance: { status: 'exact', entries: [] } as const,
+        },
+        {
+          name: 'unrecorded',
+          content: `${query} ordinary uploaded preview`,
+          provenance: { status: 'unrecorded' } as const,
+        },
+      ]
+      const fileIds: string[] = []
+      for (const source of sources) {
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(source.content),
+          `${source.name}-${generateId()}.txt`,
+          'text/plain',
+          { secretProvenance: source.provenance, notifyWorkspaceChange: false }
+        )
+        fileIds.push(file.id)
+        const sourceContentUpdatedAt = file.contentUpdatedAt ?? new Date()
+        const dispatchedAt = new Date()
+        await db
+          .insert(workspaceFileSearchRevision)
+          .values({
+            fileId: file.id,
+            workspaceId: ws(),
+            sourceContentUpdatedAt,
+            status: 'pending',
+            dispatchedAt,
+          })
+          .onConflictDoUpdate({
+            target: workspaceFileSearchRevision.fileId,
+            set: { status: 'pending', dispatchedAt, sourceContentUpdatedAt, buildId: null },
+          })
+        await indexWorkspaceFileForSearch(
+          {
+            workspaceId: ws(),
+            fileId: file.id,
+            sourceContentUpdatedAt: sourceContentUpdatedAt.toISOString(),
+            dispatchToken: dispatchedAt.toISOString(),
+          },
+          new AbortController().signal
+        )
+      }
+      const route = `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent(query)}&maxResults=3`
+      const userRead = await callV2(fixture, 'GET', route)
+      expect(userRead.status).toBe(200)
+      const userResults: Array<{ fileId: string; text: string }> = (await userRead.json()).data
+        .results
+      const protectedPreview = userResults.find((result) => result.fileId === fileIds[0])?.text
+      expect(protectedPreview).toContain(CANARY.secret.slice(0, 12))
+      expect(protectedPreview).not.toContain(CANARY.secret)
+
+      const result = await read(route)
+      expect(result.status).toBe(200)
+      const data: {
+        results: Array<{ fileId: string; lineNumber: number; text: string }>
+        count: number
+        truncated: boolean
+      } = JSON.parse(result.body).data
+      expect(data.count).toBe(3)
+      expect(data.truncated).toBe(false)
+      expect(new Set(data.results.map((entry) => entry.fileId))).toEqual(new Set(fileIds))
+      expect(data.results.find((entry) => entry.fileId === fileIds[0])).toMatchObject({
+        lineNumber: 1,
+        text: expect.stringMatching(/preview withheld/i),
+      })
+      expect(data.results.find((entry) => entry.fileId === fileIds[1])?.text).toBe(
+        sources[1].content
+      )
+      expect(data.results.find((entry) => entry.fileId === fileIds[2])?.text).toBe(
+        sources[2].content
+      )
+      expect(result.body).not.toContain(CANARY.secret.slice(0, 12))
+    })
+
+    it('keeps a one-line read within the file owner’s extraction budget', async () => {
+      const file = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`small selected line\n${CANARY.secret}\n${'.'.repeat(17 * 1024 * 1024)}`),
+        `large-line-window-${generateId()}.txt`,
+        'text/plain',
+        {
+          secretProvenance: {
+            status: 'exact',
+            entries: [
+              {
+                encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+                sourceUserId: fixture.ids.aliceId,
+                sourceWorkspaceId: ws(),
+                name: 'FIXTURE_TOKEN',
+              },
+            ],
+          },
+          notifyWorkspaceChange: false,
+        }
+      )
+      const result = await read(
+        `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=1&limit=1`
+      )
+      expect(result.status).toBe(200)
+      expect(JSON.parse(result.body).data.text).toBe('small selected line')
+      expect(result.body).not.toContain(CANARY.secret)
+    })
+
+    it('redacts a multiline secret before selecting a text line window', async () => {
+      const secret = 'RANGE_TOKEN_FIRST_LINE_64C1\nRANGE_TOKEN_SECOND_LINE_97B2'
+      const file = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`header\n${secret}\nfooter`),
+        `line-window-${generateId()}.txt`,
+        'text/plain',
+        {
+          secretProvenance: {
+            status: 'exact',
+            entries: [
+              {
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+                sourceUserId: fixture.ids.aliceId,
+                sourceWorkspaceId: ws(),
+                name: 'RANGE_TOKEN',
+              },
+            ],
+          },
+          notifyWorkspaceChange: false,
+        }
+      )
+      const result = await read(
+        `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=2&limit=1`
+      )
+      expect(result.status).toBe(200)
+      expect(JSON.parse(result.body).data.text).toBe('{{RANGE_TOKEN}}')
+      expect(result.body).not.toContain('RANGE_TOKEN_FIRST_LINE_64C1')
+      expect(result.body).not.toContain('RANGE_TOKEN_SECOND_LINE_97B2')
+      if ('sessionKey' in result) {
+        expect(await workbenchHistory(result.sessionKey)).toMatchObject({
+          status: 'exact',
+          entries: [expect.objectContaining({ name: 'RANGE_TOKEN' })],
+        })
+      }
+    })
+  })
+
   describe('run_code sandbox proxy', () => {
     it('refuses an unknown file read without tainting the workbench (O1)', async () => {
       const read = await sandbox(
@@ -796,6 +973,11 @@ describe('content reaching Chat is admitted per item', () => {
       )
       expect(zip.status).toBe(200)
       expect(zip.body).toContain(CANARY.clean)
+      expect(zip.body).toContain(CANARY.secret)
+      expect(await workbenchHistory(zip.sessionKey)).toMatchObject({
+        status: 'exact',
+        entries: [expect.objectContaining({ name: 'FIXTURE_TOKEN' })],
+      })
       expect(zip.body).not.toContain(CANARY.unknown)
       expect(zip.body).toContain('sim-download-report.json')
       expect(zip.body).toContain(fixture.files.unknown)
diff --git a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
index ee52e54213f..167d1e3b5cd 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
@@ -80,7 +80,7 @@ export async function observePrivateFile(
     const ranged = options.offset !== undefined || options.limit !== undefined
     const { text, lineRange } = sliceFileTextLines(
       ranged
-        ? redactBeforeCutting(
+        ? await redactBeforeCutting(
             undefined,
             parsed.content,
             file.source === 'knowledge' ? 'knowledge-document' : 'workspace-file'
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
index 62fc68de9bd..5873f78e370 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -221,7 +221,12 @@ describe('createRegistryContentGate', () => {
     const text = `config\n${key}\nend`
     const window = await observeContentDelivery(gate, async () => {
       expect(await gate.admit([item('key-file', exact(key))])).toEqual([true])
-      return sliceFileTextLines(redactBeforeCutting(undefined, text, 'workspace-file'), 2, 1, false)
+      return sliceFileTextLines(
+        await redactBeforeCutting(undefined, text, 'workspace-file'),
+        2,
+        1,
+        false
+      )
     })
     for (const line of key.split('\n')) expect(window.text).not.toContain(line)
   })
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index ba9da0ae097..47353248c5a 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -56,7 +56,7 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
       return true
     }
     if (provenance.entries.length === 0) return true
-    if (source.view === 'opaque') return refuse(source, 'opaque')
+    if (source.view === 'opaque' || source.view === 'excerpt') return refuse(source, 'opaque')
     const registry = scope.registry
     if (!registry) return refuse(source, 'registry')
     /** A derived view that shows nothing needs no entry; `undefined` would mean the whole item. */
@@ -72,9 +72,11 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
     project(text) {
       /** Without a registry no admitted item holds a secret, so there is nothing to redact. */
       if (!scope.registry) return text
+      /** File extraction already bounds this scalar; final egress limits the selected output. */
       const projection = projectResolvedSecretModelContent(
         text,
-        scope.registry.forkForPropagatedEntries()
+        scope.registry.forkForPropagatedEntries(),
+        Number.POSITIVE_INFINITY
       )
       return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
     },
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.ts b/apps/sim/lib/mothership/content-delivery/session-gate.ts
index f8198720631..502b169e2c1 100644
--- a/apps/sim/lib/mothership/content-delivery/session-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.ts
@@ -1,5 +1,6 @@
 import type { ContentDeliveryGate } from '@/lib/core/application/content-delivery'
 import {
+  createDurableSecretProvenanceRegistry,
   type DurableSecretProvenance,
   EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
   mergeDurableSecretProvenance,
@@ -7,6 +8,7 @@ import {
 import { reportDurableSecretProvenanceUnrecordedBatch } from '@/lib/execution/durable-secret-provenance-telemetry'
 import { recordExistingSessionFileInput } from '@/lib/execution/remote-sandbox/session-file-provenance'
 import { reportContentRefusal } from '@/lib/mothership/content-delivery/telemetry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 
 /** The workbench's history could not be widened, so nothing may enter the machine. */
 export class WorkbenchProvenanceUnavailableError extends Error {
@@ -28,6 +30,27 @@ export function createSessionContentGate(scope: {
   actorUserId: string
 }): ContentDeliveryGate {
   return {
+    async project(text, provenance) {
+      if (!provenance || provenance.status === 'unrecorded') return text
+      try {
+        const registry = await createDurableSecretProvenanceRegistry(provenance, {
+          userId: scope.actorUserId,
+          workspaceId: scope.workspaceId,
+        })
+        if (!registry) return text
+        /** File extraction already bounds this scalar; final egress limits the selected output. */
+        const projection = projectResolvedSecretModelContent(
+          text,
+          registry.forkForPropagatedEntries(),
+          Number.POSITIVE_INFINITY
+        )
+        return projection.safe && typeof projection.value === 'string'
+          ? projection.value
+          : undefined
+      } catch {
+        return undefined
+      }
+    },
     async admit(sources) {
       const verdicts: boolean[] = []
       const admitted: DurableSecretProvenance[] = []
@@ -38,6 +61,14 @@ export function createSessionContentGate(scope: {
           verdicts.push(reportContentRefusal(source, 'unknown', scope.workspaceId))
           continue
         }
+        if (
+          provenance.status === 'exact' &&
+          provenance.entries.length > 0 &&
+          source.view === 'excerpt'
+        ) {
+          verdicts.push(reportContentRefusal(source, 'opaque', scope.workspaceId))
+          continue
+        }
         if (provenance.status === 'unrecorded') {
           unrecorded += 1
           admitted.push(EXACT_EMPTY_DURABLE_SECRET_PROVENANCE)
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 5026178a10c..97ffccef839 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -219,6 +219,14 @@ async function resolveReferencedImages(
       `More than ${MAX_REFERENCED_INPUTS} referenced input files; maximum is ${MAX_REFERENCED_INPUTS}. Reference fewer files.`
     )
   }
+  return resolveReferencedFileIds(workspaceId, principal, ids)
+}
+
+async function resolveReferencedFileIds(
+  workspaceId: string,
+  principal: Principal,
+  ids: ReadonlySet<string>
+): Promise<ReferencedImageResolution> {
   if (ids.size === 0) {
     return { images: [], referenceCount: 0 }
   }
@@ -700,8 +708,7 @@ async function compileDocInLegacySandbox(
   const cached = compiledDocCache.get(cacheKey)
   let cacheReadable = true
   if (cached && args.filePrincipal && mustClassifyContent(args.filePrincipal)) {
-    const { images } = await resolveReferencedImages(
-      args.source,
+    const { images } = await resolveReferencedFileIds(
       args.workspaceId,
       args.filePrincipal,
       new Set(cached.contributingFiles?.map((file) => file.fileId))
diff --git a/apps/sim/lib/mothership/tools/server/files/workspace-file.ts b/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
index f9c861b63a1..924356b1b1b 100644
--- a/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
+++ b/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
@@ -248,7 +248,11 @@ export async function compileDocForWrite(args: {
 
   if (docInfo.isDoc) {
     try {
-      await runSandboxTask(docInfo.taskId!, { code: source, workspaceId }, { ownerKey, signal })
+      await runSandboxTask(
+        docInfo.taskId!,
+        { code: source, workspaceId },
+        { ownerKey, signal, filePrincipal: principal }
+      )
     } catch (err) {
       return {
         ok: false,
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 4aa7f109fbf..24a024f63b0 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -49,14 +49,15 @@ async function executeReadWorkspaceFileContent({
     includeOwnedFiles: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
-  const secretProvenance = input.includeSecretProvenance
-    ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-        fileId: file.id,
-        key: file.key,
-        context: file.storageContext ?? 'workspace',
-        contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-      })
-    : undefined
+  const secretProvenance =
+    input.includeSecretProvenance || isCopilotPrincipal(principal)
+      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
+          fileId: file.id,
+          key: file.key,
+          context: file.storageContext ?? 'workspace',
+          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
+        })
+      : undefined
   await requireAdmittedWorkspaceFile(
     principal,
     context.workspaceId,
@@ -82,7 +83,7 @@ async function executeReadWorkspaceFileContent({
   return {
     file,
     content,
-    ...(secretProvenance ? { secretProvenance } : {}),
+    ...(input.includeSecretProvenance && secretProvenance ? { secretProvenance } : {}),
   }
 }
 
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
index 44f94d35eaa..3c9b6c0d619 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
@@ -175,7 +175,9 @@ export async function extractWorkspaceFileRecordText(
   const truncated = metadata.truncated === true
   const ranged = input.offset !== undefined || input.limit !== undefined
   const { text, lineRange } = sliceFileTextLines(
-    ranged ? redactBeforeCutting(principal, parsed.content, 'workspace-file') : parsed.content,
+    ranged
+      ? await redactBeforeCutting(principal, parsed.content, 'workspace-file')
+      : parsed.content,
     input.offset,
     input.limit,
     truncated
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index bb41f5f6625..7030276e9ff 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -76,7 +76,7 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
         principal,
         context.workspaceId,
         found.sources.map((source) => source.identity),
-        'opaque'
+        'excerpt'
       )
       if (!classified) return found
       return {

From a5d2d82eda720d13b7238d4d90508fd5ea3f4919 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 15:45:16 -0700
Subject: [PATCH 08/13] fix(mothership): preserve file read semantics

---
 .../resolved-secret-content-projection.ts     |   6 +-
 .../utils/resolved-secret-matcher.test.ts     |  25 +++
 .../executor/utils/resolved-secret-matcher.ts |  38 +++-
 .../lib/media/ffmpeg-content.integration.ts   |  37 +++-
 .../content-delivery.integration.ts           | 206 +++++++++++++++---
 .../content-delivery/registry-gate.ts         |   3 +-
 .../content-delivery/session-gate.ts          |   3 +-
 .../application/admit-file-content.ts         |   2 +-
 .../read-workspace-file-content.ts            |  17 +-
 9 files changed, 284 insertions(+), 53 deletions(-)

diff --git a/apps/sim/executor/utils/resolved-secret-content-projection.ts b/apps/sim/executor/utils/resolved-secret-content-projection.ts
index bc7eb1f256f..be5d156c03c 100644
--- a/apps/sim/executor/utils/resolved-secret-content-projection.ts
+++ b/apps/sim/executor/utils/resolved-secret-content-projection.ts
@@ -93,6 +93,8 @@ interface ProjectionState {
 }
 
 export interface ResolvedSecretContentProjectionOptions {
+  /** Keeps original logical lines when masking complete text before a file line window. */
+  preserveLineBreaks?: boolean
   /** Values already materialized and verified by a boundary-specific projector. */
   isOpaqueSafeObject?: (value: object) => boolean
   /** Whether string-shaped secret literals should also match typed number/boolean/null values. */
@@ -304,13 +306,13 @@ function sanitizeProjectedString(
       ? sanitizeCollisionProneInternalDiagnosticIdentifiers(value, matcher)
       : value
   sanitized = matcher
-    ? sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch)
+    ? sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch, options)
     : sanitized
   if (options.sanitizeInternalIdentifiers) {
     sanitized = sanitizeInternalDiagnosticIdentifiers(sanitized)
   }
   if (matcher && containsResolvedSecret(sanitized, matcher)) {
-    sanitized = sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch)
+    sanitized = sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch, options)
     if (containsResolvedSecret(sanitized, matcher)) {
       throw new ResolvedSecretContentProjectionError(
         'Secret replacement could not produce safe model content'
diff --git a/apps/sim/executor/utils/resolved-secret-matcher.test.ts b/apps/sim/executor/utils/resolved-secret-matcher.test.ts
index 46f37faac0d..cf3fa96188e 100644
--- a/apps/sim/executor/utils/resolved-secret-matcher.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-matcher.test.ts
@@ -11,6 +11,31 @@ import {
 const PRESERVE_NAMED_PROVENANCE = { preserveNamedProvenanceLabels: true } as const
 
 describe('resolved secret matcher', () => {
+  it.each([
+    ['first-line\nsecond-line', '{{TOKEN}}\n{{TOKEN}}'],
+    ['first-line\r\nsecond-line', '{{TOKEN}}\r\n{{TOKEN}}'],
+    ['first-line\nsecond-line\n', '{{TOKEN}}\n{{TOKEN}}\n'],
+    ['first-line\n\nsecond-line', '{{TOKEN}}\n{{TOKEN}}\n{{TOKEN}}'],
+    ['\n'.repeat(8), '{{TOKEN}}\n'.repeat(8)],
+  ])(
+    'preserves line boundaries for a complete literal %j when selecting file lines',
+    (plaintext, expected) => {
+      const matcher = createResolvedSecretMatcher([{ plaintext, replacement: '{{TOKEN}}' }])
+      if (!matcher) throw new Error('Fixture literal did not produce a matcher')
+      expect(
+        sanitizeResolvedSecretString(plaintext, matcher, undefined, undefined, {
+          preserveLineBreaks: true,
+        })
+      ).toBe(expected)
+      expect(sanitizeResolvedSecretString(plaintext, matcher)).toBe('{{TOKEN}}')
+      expect(
+        sanitizeResolvedSecretString(`before ${plaintext} after`, matcher, undefined, undefined, {
+          preserveLineBreaks: true,
+        })
+      ).toBe(`before ${expected} after`)
+    }
+  )
+
   it('reports each matched literal once across large repeated content', () => {
     const matcher = createResolvedSecretMatcher([
       { plaintext: 'xxxxxxxx', replacement: '{{SHORT}}' },
diff --git a/apps/sim/executor/utils/resolved-secret-matcher.ts b/apps/sim/executor/utils/resolved-secret-matcher.ts
index 7ea20237747..2cafdb9cdb2 100644
--- a/apps/sim/executor/utils/resolved-secret-matcher.ts
+++ b/apps/sim/executor/utils/resolved-secret-matcher.ts
@@ -293,7 +293,8 @@ export function sanitizeResolvedSecretString(
   value: string,
   matcher: ResolvedSecretMatcher,
   maxBytes = MAX_INLINE_MATERIALIZATION_BYTES,
-  onMatch?: (plaintext: string) => void
+  onMatch?: (plaintext: string) => void,
+  options: { preserveLineBreaks?: boolean } = {}
 ): string {
   /**
    * A substitution can leave a literal the previous pass could not act on: an empty replacement can
@@ -302,12 +303,24 @@ export function sanitizeResolvedSecretString(
    * pathological chain from looping, and the throw past it stays the fail-closed backstop callers
    * already handle by dropping the value.
    */
-  let sanitized = substituteResolvedSecrets(value, matcher, maxBytes, onMatch)
+  let sanitized = substituteResolvedSecrets(
+    value,
+    matcher,
+    maxBytes,
+    onMatch,
+    options.preserveLineBreaks
+  )
   for (let pass = 1; containsResolvedSecret(sanitized, matcher); pass += 1) {
     if (pass >= MAX_SETTLE_PASSES) {
       throw new ResolvedSecretMatcherError('Sanitized content still contains an active secret')
     }
-    sanitized = substituteResolvedSecrets(sanitized, matcher, maxBytes, onMatch)
+    sanitized = substituteResolvedSecrets(
+      sanitized,
+      matcher,
+      maxBytes,
+      onMatch,
+      options.preserveLineBreaks
+    )
   }
   return sanitized
 }
@@ -316,7 +329,8 @@ function substituteResolvedSecrets(
   value: string,
   matcher: ResolvedSecretMatcher,
   maxBytes: number,
-  onMatch?: (plaintext: string) => void
+  onMatch?: (plaintext: string) => void,
+  preserveLineBreaks = false
 ): string {
   if (maxBytes < 0) {
     throw new ResolvedSecretMatcherError('Sanitized secret-bearing string exceeds the size limit')
@@ -356,7 +370,21 @@ function substituteResolvedSecrets(
       const slot = emitCursor % windowSize
       if (slotStarts[slot] === emitCursor && slotReplacements[slot] !== undefined) {
         append(value.slice(literalStart, emitCursor))
-        append(slotReplacements[slot] ?? '')
+        const replacement = slotReplacements[slot] ?? ''
+        if (preserveLineBreaks) {
+          const lineReplacement = replacement.replace(/[\r\n]/g, ' ') || ' '
+          const matched = value.slice(emitCursor, slotEnds[slot])
+          let position = 0
+          while (position < matched.length) {
+            append(lineReplacement)
+            const newline = matched.indexOf('\n', position)
+            if (newline < 0) break
+            append(newline > position && matched[newline - 1] === '\r' ? '\r\n' : '\n')
+            position = newline + 1
+          }
+        } else {
+          append(replacement)
+        }
         emitCursor = slotEnds[slot]
         literalStart = emitCursor
       } else {
diff --git a/apps/sim/lib/media/ffmpeg-content.integration.ts b/apps/sim/lib/media/ffmpeg-content.integration.ts
index e9b46fe7c8c..40e10ab8304 100644
--- a/apps/sim/lib/media/ffmpeg-content.integration.ts
+++ b/apps/sim/lib/media/ffmpeg-content.integration.ts
@@ -10,7 +10,10 @@ import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { generateId } from '@sim/utils/id'
 import { eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import {
+  observeContentDelivery,
+  observeContentOutsideModel,
+} from '@/lib/core/application/content-delivery'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
@@ -117,6 +120,38 @@ afterAll(async () => {
 })
 
 describe('media input version lineage', () => {
+  it.each(['known', 'unknown'] as const)(
+    'preserves the storage size-limit error for an admitted %s media source',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(SECRET),
+        `bounded-${generateId()}.bin`,
+        'application/octet-stream',
+        {
+          secretProvenance: classification === 'known' ? known : { status: 'unknown' },
+          notifyWorkspaceChange: false,
+        }
+      )
+      await expect(
+        observeContentOutsideModel(() =>
+          readWorkspaceFileContent.execute({
+            principal: createCopilotChatPrincipal(
+              { userId: ids.aliceId, workspaceId: ids.workspaceId },
+              WORKSPACE_FILES_DELEGATION_AUDIENCE
+            ),
+            input: { fileId: file.id, maxBytes: 8, includeSecretProvenance: true },
+          })
+        )
+      ).rejects.toMatchObject({
+        name: 'PayloadSizeLimitError',
+        maxBytes: 8,
+        observedBytes: Buffer.byteLength(SECRET),
+      })
+    }
+  )
+
   it.each(['known', 'unknown'] as const)(
     'does not expose storage failures for %s input bytes before a read result exists',
     async (classification) => {
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 0f2722b0e6c..71e3b1ba723 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -8,6 +8,7 @@ import { mkdtempSync } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
+import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
 import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
 import { generateId } from '@sim/utils/id'
 import JSZip from 'jszip'
@@ -24,6 +25,7 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
 }))
 /** Admission throughput is not what this suite proves. */
 vi.mock('@/lib/core/rate-limiter', () => rateLimiterMock)
+vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
 vi.mock('@/lib/embeddings', async () => ({
   ...(await import('@/lib/embeddings/client')),
   assertKnowledgeEmbeddingCapacity: async () => {},
@@ -69,14 +71,17 @@ vi.mock('@/lib/internal/tool-operations/registry.server', async (importOriginal)
 
 import { db } from '@sim/db'
 import {
+  changelogRelease,
   copilotChats,
   userTableRowSecretProvenance,
+  workflowTest,
   workspaceFileSearchRevision,
 } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
 import { eq, sql } from 'drizzle-orm'
 import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { observeContentDelivery } from '@/lib/core/application/content-delivery'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { getRedisClient } from '@/lib/core/config/redis'
 import { encryptSecret } from '@/lib/core/security/encryption'
@@ -97,11 +102,19 @@ import {
   seedContentFixture,
   seedKnowledgeConnector,
 } from '@/lib/mothership/__integration__/content-delivery-fixture'
+import { observePrivateFile } from '@/lib/mothership/agent-cli/engines/observe-private-file'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
-import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import {
+  createOwnedWorkspaceFile,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
@@ -774,6 +787,70 @@ describe('content reaching Chat is admitted per item', () => {
     })
   })
 
+  it.each(['test', 'changelog'] as const)(
+    'reads an owned %s body using its canonical provenance identity',
+    async (context) => {
+      featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(true)
+      const content = 'owned file source for an authorized read'
+      const ownerId = generateId()
+      const created = await createOwnedWorkspaceFile({
+        context,
+        workspaceId: ws(),
+        userId: fixture.ids.aliceId,
+        content,
+        contentType: 'text/plain',
+        fileName: (fileId) => `${fileId}.txt`,
+        insertOwner: async (tx, bodyFileId) => {
+          if (context === 'test') {
+            await tx.insert(workflowTest).values({
+              id: ownerId,
+              workspaceId: ws(),
+              name: ownerId,
+              title: 'Owned test fixture',
+              bodyFileId,
+              sourceHash: sha256Hex(content),
+            })
+          } else {
+            await tx.insert(changelogRelease).values({
+              id: ownerId,
+              workspaceId: ws(),
+              title: 'Owned release fixture',
+              versionMajor: 1,
+              versionMinor: 0,
+              versionPatch: 0,
+              bumpReason: 'fixture',
+              bodyFileId,
+            })
+          }
+        },
+      })
+      const principal = createCopilotChatPrincipal(
+        { userId: fixture.ids.aliceId, workspaceId: ws() },
+        WORKSPACE_FILES_DELEGATION_AUDIENCE
+      )
+      const registry = new ResolvedSecretTraceRegistry([], {
+        userId: fixture.ids.aliceId,
+        workspaceId: ws(),
+      })
+      const result = await observeContentDelivery(
+        createRegistryContentGate({
+          registry,
+          actorUserId: fixture.ids.aliceId,
+          workspaceId: ws(),
+        }),
+        () =>
+          readWorkspaceFileContent.execute({
+            principal,
+            input: { fileId: created.fileId, includeSecretProvenance: true },
+          })
+      )
+      expect(result.content.toString()).toBe(content)
+      expect(result.file.vfsNamespace).toBe(context === 'test' ? 'tests' : 'changelog')
+      expect(result.secretProvenance).toEqual({ status: 'exact', entries: [] })
+      featureFlagsMockFns.mockIsFeatureEnabled.mockReset()
+    }
+  )
+
   describe.each(['cli', 'sandbox'] as const)('%s text excerpts', (surface) => {
     const read = (route: string) => (surface === 'cli' ? cli('GET', route) : sandbox('GET', route))
 
@@ -905,43 +982,102 @@ describe('content reaching Chat is admitted per item', () => {
       expect(result.body).not.toContain(CANARY.secret)
     })
 
-    it('redacts a multiline secret before selecting a text line window', async () => {
-      const secret = 'RANGE_TOKEN_FIRST_LINE_64C1\nRANGE_TOKEN_SECOND_LINE_97B2'
-      const file = await uploadWorkspaceFile(
-        ws(),
-        fixture.ids.aliceId,
-        Buffer.from(`header\n${secret}\nfooter`),
-        `line-window-${generateId()}.txt`,
-        'text/plain',
-        {
-          secretProvenance: {
+    it.each(['\n', '\r\n'])(
+      'preserves original line positions while redacting a multiline secret (%j)',
+      async (eol) => {
+        const secret = `RANGE_TOKEN_FIRST_LINE_64C1${eol}RANGE_TOKEN_SECOND_LINE_97B2`
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(`header${eol}${secret}${eol}footer`),
+          `line-window-${generateId()}.txt`,
+          'text/plain',
+          {
+            secretProvenance: {
+              status: 'exact',
+              entries: [
+                {
+                  encryptedValue: (await encryptSecret(secret)).encrypted,
+                  sourceUserId: fixture.ids.aliceId,
+                  sourceWorkspaceId: ws(),
+                  name: 'RANGE_TOKEN',
+                },
+              ],
+            },
+            notifyWorkspaceChange: false,
+          }
+        )
+        const result = await read(
+          `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=2&limit=1`
+        )
+        expect(result.status).toBe(200)
+        expect(JSON.parse(result.body).data.text).toBe('{{RANGE_TOKEN}}')
+        expect(JSON.parse(result.body).data.lineRange).toEqual({
+          offset: 2,
+          lineCount: 1,
+          totalLines: 4,
+          totalLinesExact: true,
+        })
+        for (const [offset, expected] of [
+          [3, '{{RANGE_TOKEN}}'],
+          [4, 'footer'],
+        ] as const) {
+          const selected = await read(
+            `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=${offset}&limit=1`
+          )
+          expect(selected.status).toBe(200)
+          expect(JSON.parse(selected.body).data).toMatchObject({
+            text: expected,
+            lineRange: { offset, lineCount: 1, totalLines: 4, totalLinesExact: true },
+          })
+        }
+        if (surface === 'cli') {
+          const registry = new ResolvedSecretTraceRegistry([], {
+            userId: fixture.ids.aliceId,
+            workspaceId: ws(),
+          })
+          const privateRead = await observeContentDelivery(
+            createRegistryContentGate({
+              registry,
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            async () => {
+              const original = await readWorkspaceFileContent.execute({
+                principal: createCopilotChatPrincipal(
+                  { userId: fixture.ids.aliceId, workspaceId: ws() },
+                  WORKSPACE_FILES_DELEGATION_AUDIENCE
+                ),
+                input: { fileId: file.id },
+              })
+              return observePrivateFile(
+                {
+                  buffer: original.content,
+                  name: original.file.name,
+                  path: original.file.path,
+                  source: 'upload',
+                },
+                {},
+                { offset: 3, limit: 2 }
+              )
+            }
+          )
+          expect(privateRead.exitCode).toBe(0)
+          expect(JSON.parse(privateRead.stdout)).toMatchObject({
+            text: `{{RANGE_TOKEN}}${eol}footer`,
+            lineRange: { offset: 3, lineCount: 2, totalLines: 4, totalLinesExact: true },
+          })
+        }
+        expect(result.body).not.toContain('RANGE_TOKEN_FIRST_LINE_64C1')
+        expect(result.body).not.toContain('RANGE_TOKEN_SECOND_LINE_97B2')
+        if ('sessionKey' in result) {
+          expect(await workbenchHistory(result.sessionKey)).toMatchObject({
             status: 'exact',
-            entries: [
-              {
-                encryptedValue: (await encryptSecret(secret)).encrypted,
-                sourceUserId: fixture.ids.aliceId,
-                sourceWorkspaceId: ws(),
-                name: 'RANGE_TOKEN',
-              },
-            ],
-          },
-          notifyWorkspaceChange: false,
+            entries: [expect.objectContaining({ name: 'RANGE_TOKEN' })],
+          })
         }
-      )
-      const result = await read(
-        `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=2&limit=1`
-      )
-      expect(result.status).toBe(200)
-      expect(JSON.parse(result.body).data.text).toBe('{{RANGE_TOKEN}}')
-      expect(result.body).not.toContain('RANGE_TOKEN_FIRST_LINE_64C1')
-      expect(result.body).not.toContain('RANGE_TOKEN_SECOND_LINE_97B2')
-      if ('sessionKey' in result) {
-        expect(await workbenchHistory(result.sessionKey)).toMatchObject({
-          status: 'exact',
-          entries: [expect.objectContaining({ name: 'RANGE_TOKEN' })],
-        })
       }
-    })
+    )
   })
 
   describe('run_code sandbox proxy', () => {
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index 47353248c5a..f49a493cc6a 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -76,7 +76,8 @@ export function createRegistryContentGate(scope: RegistryContentGateScope): Cont
       const projection = projectResolvedSecretModelContent(
         text,
         scope.registry.forkForPropagatedEntries(),
-        Number.POSITIVE_INFINITY
+        Number.POSITIVE_INFINITY,
+        { preserveLineBreaks: true }
       )
       return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
     },
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.ts b/apps/sim/lib/mothership/content-delivery/session-gate.ts
index 502b169e2c1..03cffbef1e6 100644
--- a/apps/sim/lib/mothership/content-delivery/session-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.ts
@@ -42,7 +42,8 @@ export function createSessionContentGate(scope: {
         const projection = projectResolvedSecretModelContent(
           text,
           registry.forkForPropagatedEntries(),
-          Number.POSITIVE_INFINITY
+          Number.POSITIVE_INFINITY,
+          { preserveLineBreaks: true }
         )
         return projection.safe && typeof projection.value === 'string'
           ? projection.value
diff --git a/apps/sim/lib/workspace-files/application/admit-file-content.ts b/apps/sim/lib/workspace-files/application/admit-file-content.ts
index 575e93f9c0b..15c08baf84e 100644
--- a/apps/sim/lib/workspace-files/application/admit-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/admit-file-content.ts
@@ -31,7 +31,7 @@ const OWNED_CONTEXT_BY_NAMESPACE = {
 } as const satisfies Record<OwnedFileNamespace, OwnedFileContext>
 
 /** The identity a classification is bound to: these exact bytes of this exact canonical file. */
-function workspaceFileProvenanceIdentity(
+export function workspaceFileProvenanceIdentity(
   file: ClassifiableFile
 ): WorkspaceFileSecretProvenanceIdentity {
   return {
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 24a024f63b0..045be157b52 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -1,6 +1,7 @@
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
 import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import {
   type ActiveWorkspaceFileContext,
   fetchWorkspaceFileBuffer,
@@ -12,7 +13,10 @@ import {
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
-import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
+import {
+  requireAdmittedWorkspaceFile,
+  workspaceFileProvenanceIdentity,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -51,12 +55,10 @@ async function executeReadWorkspaceFileContent({
   if (!file) throw new OrchestrationError('not_found', 'File not found')
   const secretProvenance =
     input.includeSecretProvenance || isCopilotPrincipal(principal)
-      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-        })
+      ? await getBoundWorkspaceFileSecretProvenance(
+          context.workspaceId,
+          workspaceFileProvenanceIdentity(file)
+        )
       : undefined
   await requireAdmittedWorkspaceFile(
     principal,
@@ -71,6 +73,7 @@ async function executeReadWorkspaceFileContent({
       maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
     })
   } catch (error) {
+    if (isPayloadSizeLimitError(error)) throw error
     if (
       isCopilotPrincipal(principal) &&
       (secretProvenance?.status === 'unknown' ||

From 29111a9db6092e904f515bcb2d8a0ff99a3b969f Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 16:44:38 -0700
Subject: [PATCH 09/13] fix(mothership): preserve sharing and search semantics

---
 .../lib/benchmarks/application/operations.ts  |   1 +
 .../content-delivery.integration.ts           | 153 ++++++++++++++++++
 .../agent-cli/engines/universal-grep.ts       |   4 +-
 .../agent-cli/file-provenance.test.ts         |   2 +
 .../memory/application/read-scope.ts          |   2 +
 .../tools/server/files/doc-compile.test.ts    |   3 +-
 .../tools/server/files/doc-compile.ts         |  17 +-
 .../tools/server/files/doc-servable.test.ts   |   9 +-
 .../application/share-workspace-file.ts       |  29 +++-
 .../compiled-document-store.test.ts}          |   4 +-
 .../compiled-document-store.ts}               |  75 ++++++++-
 .../src/mocks/workspace-file-manager.mock.ts  |   4 +
 12 files changed, 286 insertions(+), 17 deletions(-)
 rename apps/sim/lib/{mothership/tools/server/files/doc-compiled-store.test.ts => workspace-files/compiled-document-store.test.ts} (99%)
 rename apps/sim/lib/{mothership/tools/server/files/doc-compiled-store.ts => workspace-files/compiled-document-store.ts} (73%)

diff --git a/apps/sim/lib/benchmarks/application/operations.ts b/apps/sim/lib/benchmarks/application/operations.ts
index 2225f135b7c..2546e6faa7a 100644
--- a/apps/sim/lib/benchmarks/application/operations.ts
+++ b/apps/sim/lib/benchmarks/application/operations.ts
@@ -102,6 +102,7 @@ export const benchmarkOperations = {
 
 export const benchmarkSourceOperation = defineWorkspaceOperation({
   id: 'benchmarks.source.read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 71e3b1ba723..906275c5514 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -8,6 +8,7 @@ import { mkdtempSync } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
 import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
 import { generateId } from '@sim/utils/id'
@@ -108,13 +109,22 @@ import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-de
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { resolveServableDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { getShareForResource } from '@/lib/public-shares/share-manager'
 import {
   createOwnedWorkspaceFile,
+  getWorkspaceFile,
+  updateWorkspaceFileContent as replaceFixtureFileContent,
   uploadWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import {
+  getWorkspaceFileShares,
+  updateWorkspaceFileShare,
+} from '@/lib/workspace-files/application/share-workspace-file'
+import { storeCompiledDoc } from '@/lib/workspace-files/compiled-document-store'
 import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
@@ -176,6 +186,8 @@ describe('content reaching Chat is admitted per item', () => {
 
   beforeAll(async () => {
     fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-delivery-'))
+    // Compile the lazy tool graph before request deadlines and per-case provider fixtures exist.
+    await matchV2Route('/api/v2/tools/file_get_content/execute')?.load()
     fixture = await seedContentFixture()
     connector = await seedKnowledgeConnector(fixture)
   }, 120_000)
@@ -578,6 +590,147 @@ describe('content reaching Chat is admitted per item', () => {
       expect((await share(fixture.files.entries)).status).toBe(403)
       expect((await share(fixture.files.clean)).status).toBe(200)
     })
+    it.each([
+      'clean',
+      'unrecorded',
+      'secret',
+      'unknown',
+      'old-secret',
+      'malformed',
+      'invalid',
+      'mislabeled',
+      'uploaded',
+      'legacy',
+    ] as const)(
+      'checks the published document inputs before exposing a share (%s)',
+      async (kind) => {
+        const entries = [
+          {
+            name: 'COMPILED_INPUT',
+            encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+            sourceUserId: fixture.ids.aliceId,
+            sourceWorkspaceId: ws(),
+          },
+        ]
+        const inputContent = kind === 'clean' ? CANARY.clean : CANARY.secret
+        const input = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(inputContent),
+          `compiled-input-${generateId()}.txt`,
+          'text/plain',
+          {
+            notifyWorkspaceChange: false,
+            secretProvenance:
+              kind === 'unknown'
+                ? { status: 'unknown' }
+                : kind === 'unrecorded'
+                  ? { status: 'unrecorded' }
+                  : { status: 'exact', entries: kind === 'clean' ? [] : entries },
+          }
+        )
+        const record = await getWorkspaceFile(ws(), input.id, { throwOnError: true })
+        if (!record) throw new Error('Missing compiled input fixture')
+        const source =
+          kind === 'uploaded'
+            ? '%PDF-1.7\nordinary uploaded binary'
+            : `data = open(input_path("${input.id}"), "rb").read()`
+        const document = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(source),
+          `compiled-share-${generateId()}.pdf`,
+          kind === 'mislabeled' || kind === 'uploaded' ? 'application/pdf' : 'text/x-python-pdf',
+          { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
+        )
+        const identity = JSON.stringify({
+          version: 1,
+          inputs: [
+            {
+              fileId: input.id,
+              key: record.key,
+              context: record.storageContext ?? 'workspace',
+              contentVersion: (record.contentUpdatedAt ?? record.updatedAt).toISOString(),
+              size: record.size,
+            },
+          ],
+        })
+        const artifact = Buffer.from(`%PDF-1.7\n${inputContent}`)
+        await storeCompiledDoc(
+          ws(),
+          source,
+          'pdf',
+          'application/pdf',
+          artifact,
+          kind === 'legacy'
+            ? undefined
+            : kind === 'malformed'
+              ? '{invalid'
+              : kind === 'invalid'
+                ? JSON.stringify({ version: 1, inputs: [{}] })
+                : identity
+        )
+        const published = await resolveServableDoc(ws(), Buffer.from(source), document.name)
+        expect(published.kind).toBe(kind === 'uploaded' ? 'passthrough' : 'artifact')
+        if (published.kind === 'artifact') expect(published.buffer).toEqual(artifact)
+        if (kind === 'old-secret') {
+          await replaceFixtureFileContent(
+            ws(),
+            input.id,
+            fixture.ids.aliceId,
+            Buffer.from('now clean'),
+            undefined,
+            {
+              version: { source: 'api', authorUserId: fixture.ids.aliceId },
+              secretProvenancePolicy: {
+                mode: 'replace',
+                provenance: { status: 'exact', entries: [] },
+              },
+            }
+          )
+        }
+        const allowed = ['clean', 'unrecorded', 'legacy', 'uploaded'].includes(kind)
+        const invalid = kind === 'malformed' || kind === 'invalid'
+        const activation = await cli('PATCH', `/api/v2/files/${document.id}/share`, {
+          workspaceId: ws(),
+          isActive: true,
+          authType: 'public',
+        })
+        expect.soft(activation.status).toBe(allowed ? 200 : invalid ? 500 : 403)
+        if (!allowed) expect.soft(await getShareForResource('file', document.id)).toBeNull()
+
+        const humanShare = await updateWorkspaceFileShare.execute({
+          principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
+          input: { fileId: document.id, isActive: true, authType: 'public' },
+        })
+        expect(humanShare.share.isActive).toBe(true)
+        for (const read of [cli, sandbox]) {
+          const link = await read('GET', `/api/v2/files/${document.id}/share?workspaceId=${ws()}`)
+          expect.soft(link.status).toBe(allowed ? 200 : invalid ? 500 : 403)
+          if (!allowed) expect.soft(link.body).not.toContain(humanShare.share.token)
+        }
+        if (!invalid) {
+          const result = await observeContentDelivery(
+            createRegistryContentGate({
+              registry: new ResolvedSecretTraceRegistry([]),
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            () =>
+              getWorkspaceFileShares.execute({
+                principal: createCopilotChatPrincipal(
+                  { userId: fixture.ids.aliceId, workspaceId: ws() },
+                  WORKSPACE_FILES_DELEGATION_AUDIENCE
+                ),
+                input: { workspaceId: ws(), fileIds: [document.id, fixture.files.clean] },
+              })
+          )
+          expect(result.shares.has(document.id)).toBe(allowed)
+          expect(result.shares.has(fixture.files.clean)).toBe(true)
+        }
+      }
+    )
+
     it('reads one file directly: clean as is, secrets redacted, unknown withheld whole (#1, D7)', async () => {
       const download = (fileId: string) => cli('GET', `/api/v2/files/${fileId}?workspaceId=${ws()}`)
       const clean = await download(fixture.files.clean)
diff --git a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
index b4df8bd8642..088964a2d1e 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
@@ -461,7 +461,9 @@ function clip(line: string): string {
  */
 function redactForModel(text: string, egress: ResolvedSecretTraceRegistry | undefined) {
   if (!egress) return text
-  const projection = projectResolvedSecretModelContent(text, egress)
+  const projection = projectResolvedSecretModelContent(text, egress, undefined, {
+    preserveLineBreaks: true,
+  })
   return projection.safe && typeof projection.value === 'string' ? projection.value : null
 }
 
diff --git a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
index 49bec631da3..c12adbcb0e2 100644
--- a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
@@ -623,6 +623,8 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
         'FIXTURE KEY|KEYLINE'
       )
       for (const fragment of fragments(keyBlock)) expect(projected).not.toContain(fragment)
+      const footer = await grepSecretFile(`config start\n${keyBlock}\nconfig end`, 'config end')
+      expect(footer).toContain(':6: config end')
     })
   })
 
diff --git a/apps/sim/lib/mothership/memory/application/read-scope.ts b/apps/sim/lib/mothership/memory/application/read-scope.ts
index df6b7331fc1..57cd3791f82 100644
--- a/apps/sim/lib/mothership/memory/application/read-scope.ts
+++ b/apps/sim/lib/mothership/memory/application/read-scope.ts
@@ -11,6 +11,7 @@ import { requireOwnedMemorySpace } from '@/lib/mothership/memory/spaces'
 export const MEMORY_SCOPE_AUDIENCE = 'sim:copilot-memory'
 export const readMemoryScopeOperation = defineWorkspaceOperation({
   id: 'mothership.memory.read_scope',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
@@ -23,6 +24,7 @@ export const readMemoryScope = defineAuthorizedChatUseCase({
   operation: readMemoryScopeOperation,
   organizationOperation: defineOrganizationOperation({
     id: readMemoryScopeOperation.id,
+    contentDelivery: readMemoryScopeOperation.contentDelivery,
     minimumRole: 'member',
     capability: readMemoryScopeOperation.capability,
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
index 3b0e36aef0f..48c0a50ab4d 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
@@ -29,7 +29,8 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () =>
   readWorkspaceFileMetadata: { execute: readWorkspaceFileMetadataMock },
 }))
 vi.mock('@/lib/execution/sandbox/run-task', () => ({ runSandboxTask: runSandboxTaskMock }))
-vi.mock('./doc-compiled-store', () => ({
+vi.mock('@/lib/workspace-files/compiled-document-store', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/workspace-files/compiled-document-store')>()),
   loadCompiledDoc: loadCompiledDocMock,
   loadPublishedCompiledDoc: vi.fn(),
   publishCompiledDocArtifact: publishCompiledDocArtifactMock,
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 97ffccef839..99b8c775161 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -11,18 +11,20 @@ import {
 } from '@/lib/execution/remote-sandbox'
 import { runSandboxTask } from '@/lib/execution/sandbox/run-task'
 import { DocCompileUserError } from '@/lib/mothership/tools/server/files/doc-compile-error'
+import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
+import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { admitWorkspaceFiles } from '@/lib/workspace-files/application/admit-file-content'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import {
   type CompiledDocReadOptions,
   loadCompiledDoc,
   loadPublishedCompiledDoc,
+  COMPILED_PDF_MAGIC as PDF_MAGIC,
   publishCompiledDocArtifact,
   storeCompiledDoc,
-} from '@/lib/mothership/tools/server/files/doc-compiled-store'
-import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
-import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-import { admitWorkspaceFiles } from '@/lib/workspace-files/application/admit-file-content'
-import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
-import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
+  COMPILED_ZIP_MAGIC as ZIP_MAGIC,
+} from '@/lib/workspace-files/compiled-document-store'
 import { getContentType } from '@/app/api/files/utils'
 import type { SandboxTaskId } from '@/sandbox-tasks/registry'
 
@@ -664,9 +666,6 @@ interface CompilableFormat {
   contentType: string
 }
 
-const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04])
-const PDF_MAGIC = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2d])
-
 const COMPILABLE_FORMATS: Record<string, CompilableFormat> = {
   '.pptx': { magic: ZIP_MAGIC, taskId: 'pptx-generate', contentType: PPTX_MIME },
   '.docx': { magic: ZIP_MAGIC, taskId: 'docx-generate', contentType: DOCX_MIME },
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
index d2207e71c94..5f8eaf10d8c 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
@@ -33,7 +33,8 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => (
 vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () => ({
   readWorkspaceFileMetadata: { execute: mockReadWorkspaceFileMetadata },
 }))
-vi.mock('./doc-compiled-store', () => ({
+vi.mock('@/lib/workspace-files/compiled-document-store', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/workspace-files/compiled-document-store')>()),
   loadCompiledDoc: mockLoadCompiledDoc,
   loadPublishedCompiledDoc: mockLoadPublishedCompiledDoc,
   publishCompiledDocArtifact: mockPublishCompiledDocArtifact,
@@ -48,8 +49,12 @@ vi.mock('@/app/api/files/utils', () => ({
         : 'application/octet-stream',
 }))
 
+import {
+  compileDoc,
+  resolveServableDoc,
+  resolveServableDocBytes,
+} from '@/lib/mothership/tools/server/files/doc-compile'
 import { DocCompileUserError } from '@/lib/mothership/tools/server/files/doc-compile-error'
-import { compileDoc, resolveServableDoc, resolveServableDocBytes } from './doc-compile'
 
 const { mockExecuteInSandbox } = remoteSandboxMockFns
 
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
index 96feb5797b6..bedd29c7398 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
@@ -21,16 +21,22 @@ import {
   upsertFileShare,
 } from '@/lib/public-shares/share-manager'
 import {
+  findListedWorkspaceFiles,
   getWorkspaceFile,
   loadActiveWorkspaceContext,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
+  getBoundWorkspaceFileSecretProvenanceByIdentity,
   getCurrentWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { downloadFileStream } from '@/lib/uploads/core/storage-service'
+import { getFileExtension, isRenderableDocumentName } from '@/lib/uploads/utils/file-utils'
+import { workspaceFileProvenanceIdentity } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
+import { loadPublishedCompiledDocInputs } from '@/lib/workspace-files/compiled-document-store'
 import { MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS } from '@/lib/workspace-files/limits'
 import { validatePublicFileSharing } from '@/ee/access-control/utils/permission-check'
 
@@ -97,7 +103,28 @@ async function admitSharedFiles(
   await admitContent(principal, [])
   if (!isCopilotPrincipal(principal) || fileIds.length === 0) return new Set(fileIds)
   const provenance = await getCurrentWorkspaceFileSecretProvenance(workspaceId, fileIds)
-  return new Set(fileIds.filter((id) => isShareableByChat(provenance.get(id))))
+  const shareable = new Set(fileIds.filter((id) => isShareableByChat(provenance.get(id))))
+  if (shareable.size === 0) return shareable
+  const files = await findListedWorkspaceFiles(workspaceId, [...shareable])
+  for (const id of shareable) {
+    const file = files.get(id)
+    if (!file || file.id !== id || !isRenderableDocumentName(file.name)) continue
+    const source = await downloadFileStream({
+      key: file.key,
+      context: file.storageContext ?? 'workspace',
+    })
+    const contributors = await loadPublishedCompiledDocInputs(
+      workspaceId,
+      source,
+      getFileExtension(file.name)
+    )
+    const bound = await getBoundWorkspaceFileSecretProvenanceByIdentity(workspaceId, [
+      workspaceFileProvenanceIdentity(file),
+      ...contributors,
+    ])
+    if ([...bound.values()].some((value) => !isShareableByChat(value))) shareable.delete(id)
+  }
+  return shareable
 }
 
 export const getWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts b/apps/sim/lib/workspace-files/compiled-document-store.test.ts
similarity index 99%
rename from apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts
rename to apps/sim/lib/workspace-files/compiled-document-store.test.ts
index b412d03e45d..0f2df8ae38a 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts
+++ b/apps/sim/lib/workspace-files/compiled-document-store.test.ts
@@ -4,12 +4,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 import {
   loadCompiledDoc,
   loadPublishedCompiledDoc,
   storeCompiledDoc,
-} from '@/lib/mothership/tools/server/files/doc-compiled-store'
-import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+} from '@/lib/workspace-files/compiled-document-store'
 
 const { mockDownloadFile, mockUploadFile } = storageServiceMockFns
 
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts b/apps/sim/lib/workspace-files/compiled-document-store.ts
similarity index 73%
rename from apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts
rename to apps/sim/lib/workspace-files/compiled-document-store.ts
index e98342a01e1..c78c69d55b9 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts
+++ b/apps/sim/lib/workspace-files/compiled-document-store.ts
@@ -1,13 +1,21 @@
 import { createHash } from 'node:crypto'
+import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { z } from 'zod'
+import { assertKnownSizeWithinLimit, isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { isObjectNotFoundError } from '@/lib/uploads/core/errors'
 import { downloadFile, uploadFile } from '@/lib/uploads/core/storage-service'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import { OWNED_FILE_CONTEXTS } from '@/lib/workspace-files/owned-files'
 
 const logger = createLogger('CopilotDocCompiledStore')
 
+export const COMPILED_PDF_MAGIC = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2d])
+export const COMPILED_ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04])
+
 /**
  * Compiled-artifact store for Python-generated documents.
  *
@@ -35,6 +43,14 @@ function compiledArtifactKey(
 
 function publishedArtifactPointerKey(workspaceId: string, source: string, ext: string): string {
   const sourceHash = createHash('sha256').update(source, 'utf-8').digest('hex')
+  return publishedArtifactPointerKeyFromHash(workspaceId, sourceHash, ext)
+}
+
+function publishedArtifactPointerKeyFromHash(
+  workspaceId: string,
+  sourceHash: string,
+  ext: string
+): string {
   return `copilot-doc-compiled/${workspaceId}/${sourceHash}.${ext}.published.json`
 }
 
@@ -166,6 +182,63 @@ export async function publishCompiledDocArtifact(
   }
 }
 
+const publishedInputsSchema = z.object({
+  version: z.literal(1),
+  inputs: z.array(
+    z.object({
+      fileId: z.string().min(1),
+      key: z.string().min(1),
+      context: z.enum(['workspace', 'mothership', 'execution', ...OWNED_FILE_CONTEXTS]),
+      contentVersion: z.iso.datetime(),
+    })
+  ),
+})
+
+/**
+ * Reads the published artifact's captured input revisions without loading or rebuilding its bytes.
+ * Matches public format detection: binaries stop at their header; source is hashed as streamed UTF-8.
+ */
+export async function loadPublishedCompiledDocInputs(
+  workspaceId: string,
+  sourceStream: Readable,
+  ext: string
+): Promise<WorkspaceFileSecretProvenanceIdentity[]> {
+  const magic = ext === 'pdf' ? COMPILED_PDF_MAGIC : COMPILED_ZIP_MAGIC
+  let prefix = Buffer.alloc(0)
+  let total = 0
+  const hash = createHash('sha256')
+  const decoder = new StringDecoder('utf8')
+  for await (const chunk of sourceStream) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    if (prefix.length < magic.length) {
+      prefix = Buffer.concat([prefix, bytes.subarray(0, magic.length - prefix.length)])
+      if (prefix.equals(magic)) return []
+    }
+    total += bytes.length
+    assertKnownSizeWithinLimit(total, MAX_BUFFERED_TRANSFER_BYTES, 'Compiled document source')
+    hash.update(decoder.write(bytes), 'utf8')
+  }
+  hash.update(decoder.end(), 'utf8')
+  const pointer = await loadPublishedArtifactPointer(
+    publishedArtifactPointerKeyFromHash(workspaceId, hash.digest('hex'), ext)
+  )
+  if (!pointer) return []
+  let decoded: unknown
+  try {
+    decoded = JSON.parse(pointer.referencedInputIdentity)
+  } catch {
+    throw new Error('Published compiled document inputs are malformed')
+  }
+  const parsed = publishedInputsSchema.safeParse(decoded)
+  if (!parsed.success) throw new Error('Published compiled document inputs are invalid')
+  return parsed.data.inputs.map(({ fileId, key, context, contentVersion }) => ({
+    fileId,
+    key,
+    context,
+    contentUpdatedAt: new Date(contentVersion),
+  }))
+}
+
 /** Loads an artifact previously published by an authorized compile, or null before cutover. */
 export async function loadPublishedCompiledDoc(
   workspaceId: string,
diff --git a/packages/testing/src/mocks/workspace-file-manager.mock.ts b/packages/testing/src/mocks/workspace-file-manager.mock.ts
index 2dd10d8b6e0..a8189bef9f7 100644
--- a/packages/testing/src/mocks/workspace-file-manager.mock.ts
+++ b/packages/testing/src/mocks/workspace-file-manager.mock.ts
@@ -128,6 +128,9 @@ export const workspaceFileManagerMockFns = {
   mockUpdateWorkspaceFileDimensions: vi.fn(),
   mockGetWorkspaceFileByName: vi.fn(),
   mockListWorkspaceFiles: vi.fn(),
+  mockFindListedWorkspaceFiles: vi.fn(
+    async () => new Map<string, MockWorkspaceFileLookupFields | null>()
+  ),
   mockQueryWorkspaceFiles: vi.fn(),
   mockWorkspaceFileVfsPath: vi.fn(vfsPath),
   mockGetSandboxWorkspaceFilePath: vi.fn(
@@ -199,6 +202,7 @@ export const workspaceFileManagerMock = {
   updateWorkspaceFileDimensions: fns.mockUpdateWorkspaceFileDimensions,
   getWorkspaceFileByName: fns.mockGetWorkspaceFileByName,
   listWorkspaceFiles: fns.mockListWorkspaceFiles,
+  findListedWorkspaceFiles: fns.mockFindListedWorkspaceFiles,
   queryWorkspaceFiles: fns.mockQueryWorkspaceFiles,
   workspaceFileVfsPath: fns.mockWorkspaceFileVfsPath,
   getSandboxWorkspaceFilePath: fns.mockGetSandboxWorkspaceFilePath,

From 4953af58370fcf98e7b0489d1354bf467aa71b76 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 17:19:35 -0700
Subject: [PATCH 10/13] fix(mothership): bind media admission to loaded files

---
 apps/sim/app/api/v2/lib/response.ts           |   2 +-
 .../lib/api/server/routes/copilot-request.ts  |   2 +-
 apps/sim/lib/benchmarks/application/access.ts |   1 +
 apps/sim/lib/core/application/index.ts        |  23 ++++
 .../content-reads.integration.ts              |   2 +-
 .../content-delivery.integration.ts           |   2 +-
 ...xecution-archive-provenance.integration.ts |   2 +-
 .../application/admit-knowledge-content.ts    |   2 +-
 .../authorized-knowledge-use-case.ts          |   2 +-
 .../lib/knowledge/application/chunks.test.ts  |   2 +-
 apps/sim/lib/knowledge/application/chunks.ts  |   2 +-
 .../knowledge/application/documents.test.ts   |   5 +-
 .../lib/knowledge/application/documents.ts    |   7 +-
 apps/sim/lib/knowledge/application/exports.ts |   2 +-
 .../read-original-document.test.ts            |   2 +-
 .../application/read-original-document.ts     |   2 +-
 apps/sim/lib/knowledge/application/search.ts  |   2 +-
 .../lib/knowledge/application/tags.test.ts    |   2 +-
 apps/sim/lib/knowledge/application/tags.ts    |   2 +-
 .../lib/media/ffmpeg-content.integration.ts   |   5 +-
 .../content-delivery.integration.ts           | 130 +++++++++++++++++-
 .../agent-cli/engines/observe-private-file.ts |   2 +-
 .../agent-cli/file-provenance.test.ts         |   2 +-
 .../agent-cli/file-read-transport.ts          |   2 +-
 .../agent-cli/saved-run-read.live.test.ts     |   2 +-
 .../application/authorized-chat-use-case.ts   |   2 +-
 .../chat/application/inline-images.test.ts    |   6 +-
 .../chat/application/inline-images.ts         |   7 +-
 .../chat/application/read-attachment.ts       |   3 +-
 .../application/read-sandbox-file.test.ts     |   5 +-
 .../chat/application/read-sandbox-file.ts     |   3 +-
 .../mothership/chat/process-contents.test.ts  |   3 +-
 .../lib/mothership/chat/process-contents.ts   |   2 +-
 .../content-delivery/dispatch.test.ts         |   2 +-
 .../mothership/content-delivery/dispatch.ts   |   2 +-
 .../content-delivery/registry-gate.test.ts    |   2 +-
 .../content-delivery/registry-gate.ts         |   2 +-
 .../content-delivery/session-gate.test.ts     |   2 +-
 .../content-delivery/session-gate.ts          |   2 +-
 .../mothership/content-delivery/telemetry.ts  |   2 +-
 .../lib/mothership/tool-executor/executor.ts  |   2 +-
 .../function-execute-file-mounts.test.ts      |   2 +-
 .../tools/handlers/function-execute.ts        |   5 +-
 .../workbench-confidentiality.live.test.ts    |   2 +-
 .../tools/sandbox-resource-transport.test.ts  |   2 +-
 .../tools/sandbox-resource-transport.ts       |   2 +-
 .../tools/server/files/doc-compile.test.ts    |   5 +-
 .../tools/server/files/doc-compile.ts         |   2 +-
 .../tools/server/files/file-preview.ts        |   2 +-
 .../tools/server/image/generate-image.test.ts |  17 ---
 .../tools/server/image/generate-image.ts      |   4 +-
 .../mothership/tools/server/media/ffmpeg.ts   |   2 +-
 .../tools/server/media/generate-audio.ts      |  10 +-
 .../tools/server/media/generate-video.ts      |   4 +-
 .../server/media/model-boundaries.test.ts     |  81 +----------
 .../tools/server/model-input.test.ts          |  56 --------
 .../mothership/tools/server/model-input.ts    |  24 ----
 apps/sim/lib/sim-search/live/application.ts   |   2 +-
 apps/sim/lib/table/application/operations.ts  |   2 +-
 .../table/application/read-table-snapshot.ts  |   2 +-
 apps/sim/lib/table/application/rows.test.ts   |   2 +-
 apps/sim/lib/table/application/rows.ts        |   4 +-
 .../application/execute-tool.ts               |   7 +-
 .../application/admit-run-files.test.ts       |   2 +-
 .../workflows/application/admit-run-files.ts  |   2 +-
 .../download-workflow-run-file.test.ts        |   2 +-
 .../application/download-workflow-run-file.ts |   2 +-
 .../application/read-workflow-run.ts          |   2 +-
 .../copilot-file-versions.integration.ts      |   2 +-
 .../application/admit-file-content.ts         |   2 +-
 .../download-workspace-file-items.test.ts     |   2 +-
 .../download-workspace-file-items.ts          |   2 +-
 .../download-workspace-file.test.ts           |   2 +-
 .../export-workspace-file-snapshot.ts         |   2 +-
 .../application/file-versions.ts              |   2 +-
 .../read-workspace-file-artifact.test.ts      |   2 +-
 .../read-workspace-file-content.ts            |   6 +-
 .../read-workspace-file-record.test.ts        |   5 +-
 .../read-workspace-file-secret-provenance.ts  |   2 +-
 .../read-workspace-file-text.test.ts          |   2 +-
 .../application/read-workspace-file-text.ts   |   2 +-
 .../resolve-workspace-file-reference.ts       |   2 +-
 .../search-workspace-file-content.test.ts     |   5 +-
 .../search-workspace-file-content.ts          |   2 +-
 .../application/share-workspace-file.test.ts  |   2 +-
 .../application/share-workspace-file.ts       |   6 +-
 .../update-workspace-file-content.ts          |   2 +-
 87 files changed, 259 insertions(+), 298 deletions(-)
 delete mode 100644 apps/sim/lib/mothership/tools/server/model-input.test.ts

diff --git a/apps/sim/app/api/v2/lib/response.ts b/apps/sim/app/api/v2/lib/response.ts
index 140400b8169..6b0db3d312e 100644
--- a/apps/sim/app/api/v2/lib/response.ts
+++ b/apps/sim/app/api/v2/lib/response.ts
@@ -10,11 +10,11 @@ import { type CursorKey, INVALID_CURSOR_MESSAGE } from '@/lib/api/list-query'
 import { getValidationErrorMessage, serializeZodIssues } from '@/lib/api/server'
 import { ADMISSION_RETRY_AFTER_SECONDS } from '@/lib/core/admission/transient-failure'
 import {
+  ContentDeliveryUnobservedError,
   forbiddenErrorDetails,
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
 } from '@/lib/core/application'
-import { ContentDeliveryUnobservedError } from '@/lib/core/application/content-delivery'
 import {
   asOrchestrationError,
   OrchestrationError,
diff --git a/apps/sim/lib/api/server/routes/copilot-request.ts b/apps/sim/lib/api/server/routes/copilot-request.ts
index e30fe5dafef..0cb4bc3052a 100644
--- a/apps/sim/lib/api/server/routes/copilot-request.ts
+++ b/apps/sim/lib/api/server/routes/copilot-request.ts
@@ -1,5 +1,5 @@
 import type { DelegatedPrincipal } from '@sim/auth/principal'
-import { noteContentDeliveryOperation } from '@/lib/core/application/content-delivery'
+import { noteContentDeliveryOperation } from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
 import {
diff --git a/apps/sim/lib/benchmarks/application/access.ts b/apps/sim/lib/benchmarks/application/access.ts
index 8a1f529a1da..2e619d5388b 100644
--- a/apps/sim/lib/benchmarks/application/access.ts
+++ b/apps/sim/lib/benchmarks/application/access.ts
@@ -76,6 +76,7 @@ export function defineAuthorizedBenchmarkUseCase<
 
 const targetOperation = defineOrganizationOperation({
   id: 'benchmarks.target.authorize',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'copilot.use',
   principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/core/application/index.ts b/apps/sim/lib/core/application/index.ts
index 48215ea637a..5b91b1fd8f2 100644
--- a/apps/sim/lib/core/application/index.ts
+++ b/apps/sim/lib/core/application/index.ts
@@ -61,3 +61,26 @@ export {
   type WorkspaceOperation,
 } from '@/lib/core/application/workspace-operation'
 export { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+export {
+  admitContent,
+  admitEach,
+  admitWrittenContent,
+  type ContentDeliveryDeclaration,
+  type ContentDeliveryGate,
+  ContentDeliveryUnobservedError,
+  ContentGateFailure,
+  type ContentProvenance,
+  ContentRefusedError,
+  type ContentSource,
+  type ContentSourceKind,
+  type ContentView,
+  isCopilotPrincipal,
+  mustClassifyContent,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+  observeContentOutsideModel,
+  redactBeforeCutting,
+  requireAdmittedContent,
+  runDeclaredContentOperation,
+  trackContentDelivery,
+} from './content-delivery'
diff --git a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
index 15653546417..c6cabb09ca8 100644
--- a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
+++ b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
@@ -19,7 +19,7 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
 }))
 vi.mock('@/tools', () => toolsMock)
 
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
diff --git a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
index 360258ab08b..dd68726e3b4 100644
--- a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
@@ -18,7 +18,7 @@ import { eq, inArray } from 'drizzle-orm'
 import { PostgresJsPreparedQuery } from 'drizzle-orm/postgres-js/session'
 import JSZip from 'jszip'
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
diff --git a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
index ef4502e145d..fbe7e946692 100644
--- a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
@@ -65,7 +65,7 @@ vi.mock('@/lib/embeddings', async () => ({
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import { fileManageDecompressBodySchema } from '@/lib/api/contracts/tools/file'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { processOutboxEventById } from '@/lib/core/outbox/service'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { isUserFile } from '@/lib/core/utils/user-file'
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
index 230f4b8a92b..736322e5cdf 100644
--- a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -1,5 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import { admitEach, type ContentSourceKind } from '@/lib/core/application/content-delivery'
+import { admitEach, type ContentSourceKind } from '@/lib/core/application'
 import {
   classifyKnowledgeChunks,
   classifyKnowledgeDocumentMetadata,
diff --git a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
index b3893615b6e..12a902ac374 100644
--- a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
+++ b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
@@ -5,9 +5,9 @@ import {
   type PrincipalForOperation,
   recordProjectedUseCaseAuditEntries,
   requireAllowedWorkspacePrincipal,
+  runDeclaredContentOperation,
   type WorkspaceUseCaseAuditEntry,
 } from '@/lib/core/application'
-import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import {
diff --git a/apps/sim/lib/knowledge/application/chunks.test.ts b/apps/sim/lib/knowledge/application/chunks.test.ts
index 35036aa163c..1475f02f69e 100644
--- a/apps/sim/lib/knowledge/application/chunks.test.ts
+++ b/apps/sim/lib/knowledge/application/chunks.test.ts
@@ -42,7 +42,7 @@ vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => ({
   admitKnowledgeChunks: mocks.admitKnowledgeChunks,
 }))
 
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index 2e8d37cf5a6..719f87d56ed 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -1,6 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
-import { ContentRefusedError } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError } from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
diff --git a/apps/sim/lib/knowledge/application/documents.test.ts b/apps/sim/lib/knowledge/application/documents.test.ts
index 063f56e12a5..25761ec99b6 100644
--- a/apps/sim/lib/knowledge/application/documents.test.ts
+++ b/apps/sim/lib/knowledge/application/documents.test.ts
@@ -72,9 +72,8 @@ vi.mock('@/lib/posthog/server', () => posthogServerMock)
 vi.mock('@/lib/knowledge/application/admit-knowledge-content', async (importOriginal) => {
   const original =
     await importOriginal<typeof import('@/lib/knowledge/application/admit-knowledge-content')>()
-  const delivery = await vi.importActual<typeof import('@/lib/core/application/content-delivery')>(
-    '@/lib/core/application/content-delivery'
-  )
+  const delivery =
+    await vi.importActual<typeof import('@/lib/core/application')>('@/lib/core/application')
   return {
     ...original,
     admitKnowledgeDocuments: async (
diff --git a/apps/sim/lib/knowledge/application/documents.ts b/apps/sim/lib/knowledge/application/documents.ts
index e5bcbdc8883..300ecfb3640 100644
--- a/apps/sim/lib/knowledge/application/documents.ts
+++ b/apps/sim/lib/knowledge/application/documents.ts
@@ -8,8 +8,11 @@ import {
   type BillingAttributionSnapshot,
   checkAttributedUsageLimits,
 } from '@/lib/billing/core/billing-attribution'
-import { authorizeWorkspaceOperation } from '@/lib/core/application'
-import { admitContent, ContentRefusedError } from '@/lib/core/application/content-delivery'
+import {
+  admitContent,
+  authorizeWorkspaceOperation,
+  ContentRefusedError,
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
diff --git a/apps/sim/lib/knowledge/application/exports.ts b/apps/sim/lib/knowledge/application/exports.ts
index c562b16471e..38bb7054702 100644
--- a/apps/sim/lib/knowledge/application/exports.ts
+++ b/apps/sim/lib/knowledge/application/exports.ts
@@ -7,7 +7,7 @@ import {
   ContentRefusedError,
   mustClassifyContent,
   requireAdmittedContent,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveActiveKnowledgeBaseContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
diff --git a/apps/sim/lib/knowledge/application/read-original-document.test.ts b/apps/sim/lib/knowledge/application/read-original-document.test.ts
index 5fb3d83c914..97c2d393719 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.test.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.test.ts
@@ -25,7 +25,7 @@ import {
   type ContentDeliveryGate,
   ContentRefusedError,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { readOriginalKnowledgeDocument } from '@/lib/knowledge/application/read-original-document'
diff --git a/apps/sim/lib/knowledge/application/read-original-document.ts b/apps/sim/lib/knowledge/application/read-original-document.ts
index 96982d7a372..74e21f285a5 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.ts
@@ -1,5 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
+import { requireAdmittedContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { hashDurableSecretProvenanceValue } from '@/lib/execution/durable-secret-provenance'
 import { decodeDataUriWithinLimit } from '@/lib/file-parsers/data-uri'
diff --git a/apps/sim/lib/knowledge/application/search.ts b/apps/sim/lib/knowledge/application/search.ts
index 9d5a3f0af9c..40b02571c8f 100644
--- a/apps/sim/lib/knowledge/application/search.ts
+++ b/apps/sim/lib/knowledge/application/search.ts
@@ -8,7 +8,7 @@ import {
 import { checkSearchUsageLimits } from '@/lib/billing/core/usage-gate-cache'
 import { recordUsage } from '@/lib/billing/core/usage-log'
 import { checkAndBillPayerOverageThreshold } from '@/lib/billing/threshold-billing'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeFromOwner, resourceScopeKey } from '@/lib/core/resource-scope'
 import { PlatformEvents } from '@/lib/core/telemetry'
diff --git a/apps/sim/lib/knowledge/application/tags.test.ts b/apps/sim/lib/knowledge/application/tags.test.ts
index f8ededfacc3..59e17fe3316 100644
--- a/apps/sim/lib/knowledge/application/tags.test.ts
+++ b/apps/sim/lib/knowledge/application/tags.test.ts
@@ -26,7 +26,7 @@ vi.mock('@/lib/knowledge/tags/service', () => knowledgeTagsServiceMock)
 const admission = vi.hoisted(() => ({ admitKnowledgeDocuments: vi.fn() }))
 vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => admission)
 
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import {
   createKnowledgeTag,
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index 24a36745258..6371a8ced93 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -1,7 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
diff --git a/apps/sim/lib/media/ffmpeg-content.integration.ts b/apps/sim/lib/media/ffmpeg-content.integration.ts
index 40e10ab8304..9c4557e634d 100644
--- a/apps/sim/lib/media/ffmpeg-content.integration.ts
+++ b/apps/sim/lib/media/ffmpeg-content.integration.ts
@@ -10,10 +10,7 @@ import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { generateId } from '@sim/utils/id'
 import { eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
-import {
-  observeContentDelivery,
-  observeContentOutsideModel,
-} from '@/lib/core/application/content-delivery'
+import { observeContentDelivery, observeContentOutsideModel } from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 906275c5514..88ac4d923b1 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -70,6 +70,32 @@ vi.mock('@/lib/internal/tool-operations/registry.server', async (importOriginal)
   }
 })
 
+/** Only the external media providers are replaced; file admission and stored revisions are real. */
+const mediaProvider = vi.hoisted(() => ({ calls: [] as unknown[] }))
+vi.mock('@google/genai', () => ({
+  GoogleGenAI: class {
+    models = {
+      async generateContent(input: unknown) {
+        mediaProvider.calls.push(input)
+        throw new Error('fixture media provider reached')
+      },
+    }
+  },
+}))
+vi.mock('@/lib/core/config/api-keys', () => ({ getRotatingApiKey: () => 'fixture-api-key' }))
+vi.mock('@/lib/media/falai-audio', () => ({
+  async generateFalAudio(input: unknown) {
+    mediaProvider.calls.push(input)
+    throw new Error('fixture media provider reached')
+  },
+}))
+vi.mock('@/lib/media/falai-video', () => ({
+  async generateFalVideo(input: unknown) {
+    mediaProvider.calls.push(input)
+    throw new Error('fixture media provider reached')
+  },
+}))
+
 import { db } from '@sim/db'
 import {
   changelogRelease,
@@ -82,7 +108,7 @@ import { sha256Hex } from '@sim/security/hash'
 import { eq, sql } from 'drizzle-orm'
 import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { getRedisClient } from '@/lib/core/config/redis'
 import { encryptSecret } from '@/lib/core/security/encryption'
@@ -110,6 +136,9 @@ import { createRegistryContentGate } from '@/lib/mothership/content-delivery/reg
 import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 import { resolveServableDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { generateImageServerTool } from '@/lib/mothership/tools/server/image/generate-image'
+import { generateAudioServerTool } from '@/lib/mothership/tools/server/media/generate-audio'
+import { generateVideoServerTool } from '@/lib/mothership/tools/server/media/generate-video'
 import { getShareForResource } from '@/lib/public-shares/share-manager'
 import {
   createOwnedWorkspaceFile,
@@ -1004,6 +1033,105 @@ describe('content reaching Chat is admitted per item', () => {
     }
   )
 
+  describe.each([
+    ['image', generateImageServerTool],
+    ['audio', generateAudioServerTool],
+    ['video', generateVideoServerTool],
+  ] as const)('%s reference delivery', (_kind, tool) => {
+    it.each(['clean', 'unrecorded', 'entries', 'unknown', 'changed'] as const)(
+      'classifies the bytes actually read for a %s reference before provider delivery',
+      async (classification) => {
+        mediaProvider.calls.length = 0
+        const exact: WorkspaceFileSecretProvenance = {
+          status: 'exact',
+          entries: [
+            {
+              encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+              sourceUserId: fixture.ids.aliceId,
+              sourceWorkspaceId: ws(),
+              name: 'MEDIA_REFERENCE_TOKEN',
+            },
+          ],
+        }
+        const provenance: WorkspaceFileSecretProvenance =
+          classification === 'entries'
+            ? exact
+            : classification === 'unknown'
+              ? { status: 'unknown' }
+              : classification === 'unrecorded'
+                ? { status: 'unrecorded' }
+                : { status: 'exact', entries: [] }
+        const bytes = Buffer.from(
+          classification === 'entries' ? CANARY.secret : 'ordinary reference bytes'
+        )
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          bytes,
+          `media-reference-${generateId()}.png`,
+          'image/png',
+          { secretProvenance: provenance, notifyWorkspaceChange: false }
+        )
+        const originalRead = readWorkspaceFileContent.execute.bind(readWorkspaceFileContent)
+        const interleave =
+          classification === 'changed'
+            ? vi.spyOn(readWorkspaceFileContent, 'execute').mockImplementationOnce(async (args) => {
+                await replaceFixtureFileContent(
+                  ws(),
+                  file.id,
+                  fixture.ids.aliceId,
+                  Buffer.from(CANARY.secret),
+                  undefined,
+                  {
+                    version: { source: 'api', authorUserId: fixture.ids.aliceId },
+                    secretProvenancePolicy: { mode: 'replace', provenance: exact },
+                  }
+                )
+                return originalRead(args)
+              })
+            : undefined
+        const registry = new ResolvedSecretTraceRegistry([], {
+          userId: fixture.ids.aliceId,
+          workspaceId: ws(),
+        })
+        try {
+          const result = await observeContentDelivery(
+            createRegistryContentGate({
+              registry,
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            () =>
+              tool.execute(
+                {
+                  prompt: 'ordinary request',
+                  inputs: { files: [{ path: `files/${file.name}` }] },
+                },
+                {
+                  userId: fixture.ids.aliceId,
+                  workspaceId: ws(),
+                  toolCallId: generateId(),
+                  copilotToolExecution: true,
+                  resolvedSecretTraceRegistry: registry,
+                }
+              )
+          )
+          const allowed = classification === 'clean' || classification === 'unrecorded'
+          expect(result.success).toBe(false)
+          expect(result.message).toContain(
+            allowed ? 'fixture media provider reached' : 'cannot be sent'
+          )
+          expect(mediaProvider.calls).toHaveLength(allowed ? 1 : 0)
+          if (allowed)
+            expect(JSON.stringify(mediaProvider.calls)).toContain(bytes.toString('base64'))
+          expect(registry.isPermanentlyIncomplete()).toBe(false)
+        } finally {
+          interleave?.mockRestore()
+        }
+      }
+    )
+  })
+
   describe.each(['cli', 'sandbox'] as const)('%s text excerpts', (surface) => {
     const read = (route: string) => (surface === 'cli' ? cli('GET', route) : sandbox('GET', route))
 
diff --git a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
index 167d1e3b5cd..1c88f7a57c4 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
@@ -1,4 +1,4 @@
-import { ContentRefusedError, redactBeforeCutting } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, redactBeforeCutting } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { AgentCliFlags } from '@/lib/mothership/agent-cli/types'
 import { agentCliOk } from '@/lib/mothership/agent-cli/types'
diff --git a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
index c12adbcb0e2..ea3e9c6b0c7 100644
--- a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
@@ -48,7 +48,7 @@ import {
   type ContentSource,
   noteContentDeliveryOperation,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
diff --git a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
index 3898abb0db8..fcc56801d63 100644
--- a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
@@ -4,7 +4,7 @@ import { v2DownloadFileContract, v2ReadFileTextContract } from '@/lib/api/contra
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { V2_PARSE_DEFAULTS } from '@/lib/api/server/routes/v2-json-route'
 import { parseRequest } from '@/lib/api/server/validation'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import {
   type CopilotChatDelegationContext,
   createCopilotChatPrincipal,
diff --git a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
index 1dec04fd81d..57c19ffd4e3 100644
--- a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
@@ -83,7 +83,7 @@ import {
   v2ExecuteWorkflowDataSchema,
   v2WorkflowRunStatusSchema,
 } from '@/lib/api/contracts/v2/workflows'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { env } from '@/lib/core/config/env'
 import { clearLargeValueCacheForTests } from '@/lib/execution/payloads/cache'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
diff --git a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
index 76cd0bd01b2..1ee718997ee 100644
--- a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
+++ b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
@@ -4,11 +4,11 @@ import {
   defineAuthorizedWorkspaceUseCase,
   type PrincipalForOperation,
   requireAllowedWorkspacePrincipal,
+  runDeclaredContentOperation,
   type WorkspaceAuthorizationContext,
   type WorkspaceAuthorizationOptions,
   type WorkspaceOperation,
 } from '@/lib/core/application'
-import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
 import type { OrganizationOperation } from '@/lib/core/application/organization-operation'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.test.ts b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
index 8f8b7acb9c0..c2bdbd0d6f6 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.test.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
@@ -40,11 +40,7 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-artifact', () =>
 }))
 vi.mock('@/lib/execution/remote-sandbox', () => remoteSandboxMock)
 
-import {
-  admitContent,
-  ContentRefusedError,
-  requireAdmittedContent,
-} from '@/lib/core/application/content-delivery'
+import { admitContent, ContentRefusedError, requireAdmittedContent } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   materializeInlineChatImage,
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.ts b/apps/sim/lib/mothership/chat/application/inline-images.ts
index 56d712d0973..a65f5cdea6b 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.ts
@@ -1,6 +1,9 @@
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
-import { admitContent, observeContentDelivery } from '@/lib/core/application/content-delivery'
+import {
+  admitContent,
+  defineWorkspaceOperation,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
diff --git a/apps/sim/lib/mothership/chat/application/read-attachment.ts b/apps/sim/lib/mothership/chat/application/read-attachment.ts
index 08929ca0175..f53e65d7883 100644
--- a/apps/sim/lib/mothership/chat/application/read-attachment.ts
+++ b/apps/sim/lib/mothership/chat/application/read-attachment.ts
@@ -1,6 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
-import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
+import { defineWorkspaceOperation, requireAdmittedContent } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
index b577011acbd..1afb2bd1acf 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
@@ -6,10 +6,7 @@ import {
 } from '@sim/testing/factories/principal.factory'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import {
-  ContentRefusedError,
-  observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, observeContentDelivery } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
index c1268a02875..65c89afc53a 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
@@ -1,7 +1,6 @@
 import { posix } from 'node:path'
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
-import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
+import { defineWorkspaceOperation, requireAdmittedContent } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { readStreamToBufferWithLimit } from '@/lib/core/utils/stream-limits'
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 8094b1ce2d2..aa2a33fa9b4 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -37,8 +37,7 @@ import {
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
-import { DelegatedWorkspaceAuthorizationError } from '@/lib/core/application'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent, DelegatedWorkspaceAuthorizationError } from '@/lib/core/application'
 import {
   MAX_TABLE_SELECTION_PREVIEW_LENGTH,
   MAX_TABLE_SELECTION_ROWS,
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 414cd3dd574..047d571b2b6 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -8,7 +8,7 @@ import {
 import { escapeRegExp } from '@sim/utils/string'
 import { eq } from 'drizzle-orm'
 import type { MothershipTableViewContext } from '@/lib/api/contracts/mothership-resources'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
index 3ec9dc6d1fb..b03ab096ed5 100644
--- a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
@@ -10,7 +10,7 @@ import {
   type ContentSource,
   noteContentDeliveryOperation,
   runDeclaredContentOperation,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 import {
   deliveredFileProvenance,
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.ts b/apps/sim/lib/mothership/content-delivery/dispatch.ts
index ef8383d2293..6d8e07335d3 100644
--- a/apps/sim/lib/mothership/content-delivery/dispatch.ts
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.ts
@@ -4,7 +4,7 @@ import {
   type ContentProvenance,
   observeContentDelivery,
   trackContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import {
   mergeWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
index 5873f78e370..61fcec2f5da 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -16,7 +16,7 @@ import {
   type ContentSource,
   observeContentDelivery,
   redactBeforeCutting,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { PROVENANCE_MAX_ENTRIES } from '@/lib/execution/provenance-limits'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { sliceFileTextLines } from '@/lib/workspace-files/text-lines'
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
index f49a493cc6a..6dc499c4324 100644
--- a/apps/sim/lib/mothership/content-delivery/registry-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -1,4 +1,4 @@
-import type { ContentDeliveryGate, ContentSource } from '@/lib/core/application/content-delivery'
+import type { ContentDeliveryGate, ContentSource } from '@/lib/core/application'
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
   type DurableSecretProvenanceUnrecordedReport,
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
index 99338ac8fb8..164c2646bb7 100644
--- a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
@@ -12,7 +12,7 @@ const telemetry = vi.hoisted(() => ({
 }))
 vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
 
-import type { ContentProvenance, ContentSource } from '@/lib/core/application/content-delivery'
+import type { ContentProvenance, ContentSource } from '@/lib/core/application'
 import {
   createSessionContentGate,
   WorkbenchProvenanceUnavailableError,
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.ts b/apps/sim/lib/mothership/content-delivery/session-gate.ts
index 03cffbef1e6..a5fc9e387f3 100644
--- a/apps/sim/lib/mothership/content-delivery/session-gate.ts
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.ts
@@ -1,4 +1,4 @@
-import type { ContentDeliveryGate } from '@/lib/core/application/content-delivery'
+import type { ContentDeliveryGate } from '@/lib/core/application'
 import {
   createDurableSecretProvenanceRegistry,
   type DurableSecretProvenance,
diff --git a/apps/sim/lib/mothership/content-delivery/telemetry.ts b/apps/sim/lib/mothership/content-delivery/telemetry.ts
index cb2d45cad79..658aee2a55e 100644
--- a/apps/sim/lib/mothership/content-delivery/telemetry.ts
+++ b/apps/sim/lib/mothership/content-delivery/telemetry.ts
@@ -1,4 +1,4 @@
-import type { ContentSource, ContentSourceKind } from '@/lib/core/application/content-delivery'
+import type { ContentSource, ContentSourceKind } from '@/lib/core/application'
 import {
   type DurableSecretProvenanceRefusalCause,
   type DurableSecretProvenanceSurface,
diff --git a/apps/sim/lib/mothership/tool-executor/executor.ts b/apps/sim/lib/mothership/tool-executor/executor.ts
index a733f906abc..de809a77612 100644
--- a/apps/sim/lib/mothership/tool-executor/executor.ts
+++ b/apps/sim/lib/mothership/tool-executor/executor.ts
@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
 import { toError } from '@sim/utils/errors'
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
index d3a5d713e5a..574901baba0 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
@@ -34,7 +34,7 @@ vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/tools', () => toolsMock)
 
-import { observeContentDelivery } from '@/lib/core/application/content-delivery'
+import { observeContentDelivery } from '@/lib/core/application'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute.ts b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
index 726ba9d292e..190dca23d55 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
@@ -2,10 +2,7 @@ import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { omit, toRecord } from '@sim/utils/object'
 import { hasWorkspaceSandboxAccess } from '@/lib/billing/core/subscription'
-import {
-  ContentRefusedError,
-  observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, observeContentDelivery } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   durableSecretProvenanceFromEnvelope,
diff --git a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
index 64f5fccc1de..c857545957a 100644
--- a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
@@ -68,7 +68,7 @@ import {
   admitWrittenContent,
   type ContentProvenance,
   runDeclaredContentOperation,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
index 534f07aa8c4..86d5dd13e03 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
@@ -10,7 +10,7 @@ import {
   type ContentSource,
   noteContentDeliveryOperation,
   requireAdmittedContent,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { assertWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index 136e0f96efa..b6361660268 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -3,7 +3,7 @@ import { generateId } from '@sim/utils/id'
 import { NextRequest } from 'next/server'
 import { markCopilotRequest } from '@/lib/api/server/routes/copilot-request'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { ContentGateFailure } from '@/lib/core/application/content-delivery'
+import { ContentGateFailure } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
index 48c0a50ab4d..0e1b68beeee 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
@@ -37,10 +37,7 @@ vi.mock('@/lib/workspace-files/compiled-document-store', async (importOriginal)
   storeCompiledDoc: storeCompiledDocMock,
 }))
 
-import {
-  type ContentDeliveryGate,
-  observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { collectReferencedFileIds, compileDoc } from './doc-compile'
 
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 99b8c775161..5224b4acb61 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -1,7 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
-import { ContentRefusedError, mustClassifyContent } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError, mustClassifyContent } from '@/lib/core/application'
 import { isDocSandboxEnabled } from '@/lib/core/config/env-flags'
 import { CodeLanguage } from '@/lib/execution/languages'
 import {
diff --git a/apps/sim/lib/mothership/tools/server/files/file-preview.ts b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
index 2b34de4bd7a..d97093614e8 100644
--- a/apps/sim/lib/mothership/tools/server/files/file-preview.ts
+++ b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { observeContentOutsideModel } from '@/lib/core/application/content-delivery'
+import { observeContentOutsideModel } from '@/lib/core/application'
 import { executeCopilotFileUseCase } from '@/lib/mothership/application/execute-file-use-case'
 import type { ExecutionContext } from '@/lib/mothership/request/types'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
diff --git a/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts b/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
index 23b28808d78..58391d34b22 100644
--- a/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
+++ b/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
@@ -55,7 +55,6 @@ import { generateImageServerTool } from '@/lib/mothership/tools/server/image/gen
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
 const { mockResolveWorkspaceFileReference } = workspaceFileReferenceMockFns
 workspaceFileSecretProvenanceMockFns.mockCreateWorkspaceFileSecretProvenanceFromRegistry.mockImplementation(
   async () => ({ safe: true, provenance: { status: 'exact', entries: [] } })
@@ -106,7 +105,6 @@ function generate(paths: string[]) {
 
 describe('generate_image reference images', () => {
   beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
     mockResolveWorkspaceFileReference.mockResolvedValue(chatUpload)
     mockReadWorkspaceFileContent.mockResolvedValue({
       file: chatUpload,
@@ -207,19 +205,4 @@ describe('generate_image reference images', () => {
     )
     expect(mockGenerateContent).not.toHaveBeenCalled()
   })
-
-  it('still refuses a model-unsafe reference with the safety message', async () => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-    const result = await generate(['uploads/face.png'])
-
-    expect(result).toEqual(
-      expect.objectContaining({
-        success: false,
-        message: expect.stringContaining('cannot be sent'),
-      })
-    )
-    expect(mockReadWorkspaceFileContent).not.toHaveBeenCalled()
-    expect(mockGenerateContent).not.toHaveBeenCalled()
-  })
 })
diff --git a/apps/sim/lib/mothership/tools/server/image/generate-image.ts b/apps/sim/lib/mothership/tools/server/image/generate-image.ts
index f1faadc2135..096e4f63dc4 100644
--- a/apps/sim/lib/mothership/tools/server/image/generate-image.ts
+++ b/apps/sim/lib/mothership/tools/server/image/generate-image.ts
@@ -15,7 +15,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -83,7 +82,7 @@ async function loadReferenceImage(
     }
     throw error
   }
-  await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file })
+
   try {
     const { content } = await executeCopilotFileUseCase(
       context,
@@ -92,6 +91,7 @@ async function loadReferenceImage(
         fileId: file.id,
         assertedWorkspaceId: workspaceId,
         maxBytes: MAX_MEDIA_BYTES,
+        contentView: 'opaque',
       },
       { fileId: file.id }
     )
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
index 4818a35ffb3..aa13ad4258b 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { observeContentOutsideModel } from '@/lib/core/application/content-delivery'
+import { observeContentOutsideModel } from '@/lib/core/application'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { MAX_MEDIA_BYTES } from '@/lib/media/falai'
 import { type FfmpegOperation, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
diff --git a/apps/sim/lib/mothership/tools/server/media/generate-audio.ts b/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
index 9c1caa7507b..44afdb84f96 100644
--- a/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
+++ b/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
@@ -13,7 +13,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -99,11 +98,16 @@ export const generateAudioServerTool: BaseServerTool<GenerateAudioArgs, Generate
             reference: samplePath,
           }
         )
-        await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file: sample })
+
         const { content: sampleBuffer } = await executeCopilotFileUseCase(
           context,
           readWorkspaceFileContent,
-          { fileId: sample.id, assertedWorkspaceId: workspaceId, maxBytes: MAX_MEDIA_BYTES },
+          {
+            fileId: sample.id,
+            assertedWorkspaceId: workspaceId,
+            maxBytes: MAX_MEDIA_BYTES,
+            contentView: 'opaque',
+          },
           { fileId: sample.id }
         )
         const sampleMime = sample.type || 'audio/mpeg'
diff --git a/apps/sim/lib/mothership/tools/server/media/generate-video.ts b/apps/sim/lib/mothership/tools/server/media/generate-video.ts
index efa11178bdf..95bfed86039 100644
--- a/apps/sim/lib/mothership/tools/server/media/generate-video.ts
+++ b/apps/sim/lib/mothership/tools/server/media/generate-video.ts
@@ -13,7 +13,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -76,7 +75,7 @@ export const generateVideoServerTool: BaseServerTool<GenerateVideoArgs, Generate
             reference: refPath,
           }
         )
-        await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file: fileRecord })
+
         const { content: buffer } = await executeCopilotFileUseCase(
           context,
           readWorkspaceFileContent,
@@ -84,6 +83,7 @@ export const generateVideoServerTool: BaseServerTool<GenerateVideoArgs, Generate
             fileId: fileRecord.id,
             assertedWorkspaceId: workspaceId,
             maxBytes: MAX_MEDIA_BYTES,
+            contentView: 'opaque',
           },
           { fileId: fileRecord.id }
         )
diff --git a/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts b/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
index c01c6f50fb3..6405fae671f 100644
--- a/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
+++ b/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
@@ -1,11 +1,4 @@
-import {
-  workspaceFileReferenceMock,
-  workspaceFileReferenceMockFns,
-} from '@sim/testing/mocks/workspace-file-reference.mock'
-import {
-  workspaceFileSecretProvenanceMock,
-  workspaceFileSecretProvenanceMockFns,
-} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
+import { workspaceFileSecretProvenanceMock } from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { observeServiceCosts } from '@/lib/mothership/billing/service-observer'
 
@@ -13,17 +6,13 @@ const {
   mockGenerateContent,
   mockGenerateFalAudio,
   mockGenerateFalVideo,
-  mockReadWorkspaceFileContent,
   mockWriteWorkspaceFileByPath,
 } = vi.hoisted(() => ({
   mockGenerateContent: vi.fn(),
   mockGenerateFalAudio: vi.fn(),
   mockGenerateFalVideo: vi.fn(),
-  mockReadWorkspaceFileContent: vi.fn(),
   mockWriteWorkspaceFileByPath: vi.fn(),
 }))
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
-const { mockResolveWorkspaceFileReference } = workspaceFileReferenceMockFns
 
 vi.mock('@google/genai', () => ({
   GoogleGenAI: class GoogleGenAI {
@@ -36,13 +25,6 @@ vi.mock('@/lib/mothership/vfs/resource-writer', () => ({
 }))
 vi.mock('@/lib/media/falai-audio', () => ({ generateFalAudio: mockGenerateFalAudio }))
 vi.mock('@/lib/media/falai-video', () => ({ generateFalVideo: mockGenerateFalVideo }))
-vi.mock(
-  '@/lib/workspace-files/application/resolve-workspace-file-reference',
-  () => workspaceFileReferenceMock
-)
-vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => ({
-  readWorkspaceFileContent: { execute: mockReadWorkspaceFileContent },
-}))
 vi.mock(
   '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
   () => workspaceFileSecretProvenanceMock
@@ -54,20 +36,6 @@ import { generateAudioServerTool } from '@/lib/mothership/tools/server/media/gen
 import { generateVideoServerTool } from '@/lib/mothership/tools/server/media/generate-video'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
-const file = {
-  id: 'file-1',
-  workspaceId: 'workspace-1',
-  name: 'reference.png',
-  key: 'workspace/workspace-1/reference.png',
-  path: '/api/files/serve/reference.png',
-  size: 10,
-  type: 'image/png',
-  uploadedBy: 'user-1',
-  uploadedAt: new Date('2026-08-05T00:00:00.000Z'),
-  updatedAt: new Date('2026-08-05T00:00:00.000Z'),
-  storageContext: 'workspace' as const,
-}
-
 function contextWithSecrets(
   entries: Array<{ name: string; plaintext: string }>
 ): ServerToolContext {
@@ -86,9 +54,6 @@ function contextWithSecrets(
 
 describe('Mothership media model boundaries', () => {
   beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
-    mockResolveWorkspaceFileReference.mockResolvedValue(file)
-    mockReadWorkspaceFileContent.mockResolvedValue({ file, content: Buffer.from('opaque-media') })
     mockWriteWorkspaceFileByPath.mockResolvedValue({
       id: 'output-1',
       name: 'output.bin',
@@ -184,48 +149,4 @@ describe('Mothership media model boundaries', () => {
       expect.objectContaining({ prompt: 'private prompt', lyrics: 'private lyrics' })
     )
   })
-
-  it.each([
-    [
-      'image',
-      () =>
-        generateImageServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.png' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-    [
-      'video',
-      () =>
-        generateVideoServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.png' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-    [
-      'audio',
-      () =>
-        generateAudioServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.mp3' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-  ])(
-    'rejects unsafe %s references before fetching bytes or calling a model',
-    async (_name, run) => {
-      mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-      await expect(run()).resolves.toEqual(
-        expect.objectContaining({
-          success: false,
-          message: expect.stringContaining('cannot be sent'),
-        })
-      )
-
-      expect(mockReadWorkspaceFileContent).not.toHaveBeenCalled()
-      expect(mockGenerateContent).not.toHaveBeenCalled()
-      expect(mockGenerateFalVideo).not.toHaveBeenCalled()
-      expect(mockGenerateFalAudio).not.toHaveBeenCalled()
-    }
-  )
 })
diff --git a/apps/sim/lib/mothership/tools/server/model-input.test.ts b/apps/sim/lib/mothership/tools/server/model-input.test.ts
deleted file mode 100644
index 731172560c9..00000000000
--- a/apps/sim/lib/mothership/tools/server/model-input.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import {
-  workspaceFileSecretProvenanceMock,
-  workspaceFileSecretProvenanceMockFns,
-} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
-
-vi.mock(
-  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
-  () => workspaceFileSecretProvenanceMock
-)
-
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
-
-const file = {
-  id: 'file-1',
-  workspaceId: 'workspace-1',
-  name: 'reference.png',
-  key: 'workspace/workspace-1/reference.png',
-  path: '/api/files/serve/reference.png',
-  size: 10,
-  type: 'image/png',
-  uploadedBy: 'user-1',
-  uploadedAt: new Date('2026-08-05T00:00:00.000Z'),
-  updatedAt: new Date('2026-08-05T00:00:00.000Z'),
-  storageContext: 'workspace' as const,
-}
-
-describe('server tool model-input boundary', () => {
-  beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
-  })
-
-  it('binds opaque checks to the exact workspace file before allowing model egress', async () => {
-    await expect(
-      assertOpaqueWorkspaceFileModelSafe({
-        workspaceId: 'workspace-1',
-        file,
-      })
-    ).resolves.toBeUndefined()
-    expect(mockIsOpaqueWorkspaceFileEgressSafe).toHaveBeenCalledWith('workspace-1', {
-      fileId: 'file-1',
-      key: 'workspace/workspace-1/reference.png',
-      context: 'workspace',
-    })
-  })
-
-  it('rejects tainted or unavailable opaque provenance', async () => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-    await expect(
-      assertOpaqueWorkspaceFileModelSafe({ workspaceId: 'workspace-1', file })
-    ).rejects.toThrow('File cannot be sent to a model')
-  })
-})
diff --git a/apps/sim/lib/mothership/tools/server/model-input.ts b/apps/sim/lib/mothership/tools/server/model-input.ts
index 6790c53e825..d200573993a 100644
--- a/apps/sim/lib/mothership/tools/server/model-input.ts
+++ b/apps/sim/lib/mothership/tools/server/model-input.ts
@@ -1,30 +1,6 @@
-import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  isOpaqueWorkspaceFileEgressSafe,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-
 export class ServerToolModelInputError extends Error {
   constructor(message: string) {
     super(message)
     this.name = 'ServerToolModelInputError'
   }
 }
-
-/**
- * Verifies the exact persisted provenance bound to an opaque workspace file before its bytes leave
- * Sim. Opaque media cannot be rewritten safely, so tracked or unavailable provenance is rejected.
- */
-export async function assertOpaqueWorkspaceFileModelSafe(args: {
-  workspaceId: string
-  file: WorkspaceFileRecord
-}): Promise<void> {
-  const safe = await isOpaqueWorkspaceFileEgressSafe(args.workspaceId, {
-    fileId: args.file.id,
-    key: args.file.key,
-    context: args.file.storageContext ?? 'workspace',
-  })
-  if (!safe) {
-    throw new ServerToolModelInputError(MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-  }
-}
diff --git a/apps/sim/lib/sim-search/live/application.ts b/apps/sim/lib/sim-search/live/application.ts
index d8d23667172..2a699fea629 100644
--- a/apps/sim/lib/sim-search/live/application.ts
+++ b/apps/sim/lib/sim-search/live/application.ts
@@ -17,7 +17,7 @@ import {
   workspaceSearchFiltersSchema,
 } from '@/lib/api/contracts/mothership-assistant-tools'
 import { canonicalJson, fingerprint, instantScopePart } from '@/lib/api/cursor-binding'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { env } from '@/lib/core/config/env'
 import { isRetryableNetworkError } from '@/lib/core/errors/retryable-infrastructure'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
diff --git a/apps/sim/lib/table/application/operations.ts b/apps/sim/lib/table/application/operations.ts
index 0b8bf6f2e6e..6d7531d8c99 100644
--- a/apps/sim/lib/table/application/operations.ts
+++ b/apps/sim/lib/table/application/operations.ts
@@ -1,4 +1,4 @@
-import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
+import type { ContentDeliveryDeclaration } from '@/lib/core/application'
 import type { OperationDeclarableCapability } from '@/lib/core/application/operation'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 
diff --git a/apps/sim/lib/table/application/read-table-snapshot.ts b/apps/sim/lib/table/application/read-table-snapshot.ts
index ed34ad76f26..334466daee5 100644
--- a/apps/sim/lib/table/application/read-table-snapshot.ts
+++ b/apps/sim/lib/table/application/read-table-snapshot.ts
@@ -1,4 +1,4 @@
-import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
+import { requireAdmittedContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index db8b0d6a462..ba6f8635345 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -79,7 +79,7 @@ import {
   ContentRefusedError,
   type ContentSource,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { TABLE_LIMITS } from '@/lib/table'
 import {
   batchUpdateTableRows,
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index 18e34b35a2f..b10607ebbbc 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -5,14 +5,14 @@ import { db } from '@sim/db'
 import { getRequestContext } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { isPlainRecord, toRecord } from '@sim/utils/object'
-import { capabilityGovernedPrincipalUserId } from '@/lib/core/application'
 import {
   admitContent,
   admitWrittenContent,
   ContentRefusedError,
+  capabilityGovernedPrincipalUserId,
   isCopilotPrincipal,
   mustClassifyContent,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPrivateSecretProvenanceScopeCompatible } from '@/lib/execution/durable-secret-provenance'
 import type {
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.ts b/apps/sim/lib/tool-execution/application/execute-tool.ts
index 7c92eb0ea14..ff672cbcabe 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.ts
@@ -13,8 +13,11 @@ import {
   resolveVisibleToolId,
   resolveVisibleToolOwners,
 } from '@/lib/catalog/application/tool-scope'
-import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
-import { admitWrittenContent, mustClassifyContent } from '@/lib/core/application/content-delivery'
+import {
+  admitWrittenContent,
+  defineAuthorizedWorkspaceUseCase,
+  mustClassifyContent,
+} from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
index fed0f61af78..4c6eec1e5e2 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.test.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -24,7 +24,7 @@ import {
   type ContentDeliveryGate,
   ContentRefusedError,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import {
   admitRunFiles,
   inlinesRunFiles,
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
index 1b3e5fe44a6..717cd3ef7cd 100644
--- a/apps/sim/lib/workflows/application/admit-run-files.ts
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -5,7 +5,7 @@ import {
   ContentRefusedError,
   type ContentView,
   isCopilotPrincipal,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
 import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import type { UserFile } from '@/executor/types'
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
index b6569f517fa..55c5485aea3 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
@@ -40,7 +40,7 @@ import {
   ContentRefusedError,
   isCopilotPrincipal,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { downloadWorkflowRunFileStream } from '@/lib/workflows/application/download-workflow-run-file'
 
 /** Chat's gate with no registry: it admits only a file with no recorded secret. */
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
index b2faf42a55b..de65b6721fd 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
-import { ContentRefusedError } from '@/lib/core/application/content-delivery'
+import { ContentRefusedError } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { nodeReadableToWebStream } from '@/lib/core/utils/node-stream'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
diff --git a/apps/sim/lib/workflows/application/read-workflow-run.ts b/apps/sim/lib/workflows/application/read-workflow-run.ts
index 73444cc90dc..ad29de11189 100644
--- a/apps/sim/lib/workflows/application/read-workflow-run.ts
+++ b/apps/sim/lib/workflows/application/read-workflow-run.ts
@@ -1,5 +1,5 @@
 import { isValidUuid } from '@sim/utils/id'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   FUNCTIONAL_OUTPUTS_UNAVAILABLE_MESSAGE,
diff --git a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
index 8b4462944e8..dae19c5f9a2 100644
--- a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
+++ b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
@@ -30,7 +30,7 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
   },
 }))
 
-import { ContentDeliveryUnobservedError } from '@/lib/core/application/content-delivery'
+import { ContentDeliveryUnobservedError } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
diff --git a/apps/sim/lib/workspace-files/application/admit-file-content.ts b/apps/sim/lib/workspace-files/application/admit-file-content.ts
index 15c08baf84e..3e8a8898fa0 100644
--- a/apps/sim/lib/workspace-files/application/admit-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/admit-file-content.ts
@@ -6,7 +6,7 @@ import {
   type ContentView,
   mustClassifyContent,
   requireAdmittedContent,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import {
   getBoundWorkspaceFileSecretProvenance,
   getBoundWorkspaceFileSecretProvenanceByIdentity,
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
index a1decb186ed..19d10a8b0b2 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
@@ -52,7 +52,7 @@ import {
   type ContentDeliveryGate,
   ContentRefusedError,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 
 const mockProvenance =
   workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index 5f216d13a16..32976b7be39 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -1,9 +1,9 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import {
   type AuthorizedWorkspaceUseCaseContext,
+  ContentRefusedError,
   capabilityGovernedPrincipalUserId,
 } from '@/lib/core/application'
-import { ContentRefusedError } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { parseFolderPath } from '@/lib/folders/paths'
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
index 4dc30b0e7d2..5b3a5376fe1 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
@@ -20,7 +20,7 @@ import {
   ContentRefusedError,
   type ContentSource,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 
 class FakeDocNotReadyError extends Error {}
diff --git a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
index e088ce40cae..e58263566ec 100644
--- a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
+++ b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
@@ -1,7 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { PASTE_LIMITS, utf8ByteLength } from '@sim/utils/paste'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { asOrchestrationError, OrchestrationError } from '@/lib/core/orchestration/types'
 import { MATERIALIZE_CONCURRENCY, mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
diff --git a/apps/sim/lib/workspace-files/application/file-versions.ts b/apps/sim/lib/workspace-files/application/file-versions.ts
index 3313c7d5ef1..20acf946c24 100644
--- a/apps/sim/lib/workspace-files/application/file-versions.ts
+++ b/apps/sim/lib/workspace-files/application/file-versions.ts
@@ -2,7 +2,7 @@ import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import type { CursorKey, ListSortOrder } from '@/lib/api/list-query'
-import { mustClassifyContent } from '@/lib/core/application/content-delivery'
+import { mustClassifyContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { notifyWorkspaceFilesChanged } from '@/lib/realtime/notify'
 import { getServePathPrefix } from '@/lib/uploads'
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
index 27494b0523c..f6c2f7041fc 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
@@ -31,7 +31,7 @@ import {
   type ContentDeliveryGate,
   ContentRefusedError,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { readWorkspaceFileArtifact } from '@/lib/workspace-files/application/read-workspace-file-artifact'
 
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 045be157b52..2d102681b9c 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -1,5 +1,5 @@
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
-import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
+import { isCopilotPrincipal } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import {
@@ -26,6 +26,8 @@ export interface ReadWorkspaceFileContentInput {
   assertedWorkspaceId?: string
   /** Optional post-authorization storage ceiling for bounded binary reads. */
   maxBytes?: number
+  /** Opaque model inputs bypass text projection and must be admitted before loading bytes. */
+  contentView?: 'complete' | 'opaque'
   includeDeleted?: boolean
   /** Loads the exact provenance bound to the authorized file version when requested. */
   includeSecretProvenance?: boolean
@@ -64,7 +66,7 @@ async function executeReadWorkspaceFileContent({
     principal,
     context.workspaceId,
     file,
-    'complete',
+    input.contentView ?? 'complete',
     secretProvenance
   )
   let content: Buffer
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
index 84550a9e079..5d988956bc5 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
@@ -18,10 +18,7 @@ vi.mock(
   () => workspaceFileSecretProvenanceMock
 )
 
-import {
-  type ContentDeliveryGate,
-  observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   downloadWorkspaceFileRecord,
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
index 04074cae8ae..cefbfe82b59 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
@@ -1,5 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
index be83e9c2592..54fdf25422e 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
@@ -25,7 +25,7 @@ import {
   ContentRefusedError,
   type ContentSource,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { FileParserError } from '@/lib/file-parsers/errors'
 
 const hoisted = vi.hoisted(() => ({
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
index 3c9b6c0d619..f7fb10bd89f 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
@@ -1,7 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
-import { redactBeforeCutting } from '@/lib/core/application/content-delivery'
+import { redactBeforeCutting } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isSupportedFileType } from '@/lib/file-parsers'
diff --git a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
index 682c848e4b6..a561b4b5c9e 100644
--- a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
+++ b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
@@ -1,6 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { OperationUseCase, WorkspaceOperation } from '@/lib/core/application'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   type ActiveWorkspaceFileContext,
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
index ffaffda3cf0..d2d644e4e1d 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
@@ -27,10 +27,7 @@ vi.mock('@/lib/workspace-files/resolve-folder-scope', () => ({
   resolveWorkspaceFolderScope: hoisted.folders,
 }))
 
-import {
-  type ContentDeliveryGate,
-  observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index 7030276e9ff..b8baae70c61 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -1,4 +1,4 @@
-import { isCopilotPrincipal } from '@/lib/core/application/content-delivery'
+import { isCopilotPrincipal } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { loadActiveWorkspaceContext } from '@/lib/uploads/contexts/workspace'
 import { admitWorkspaceFileIdentities } from '@/lib/workspace-files/application/admit-file-content'
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
index 498530355e3..a6bd7b1da35 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
@@ -35,7 +35,7 @@ import {
   type ContentDeliveryGate,
   ContentRefusedError,
   observeContentDelivery,
-} from '@/lib/core/application/content-delivery'
+} from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
index bedd29c7398..3b080c572ae 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
@@ -6,11 +6,7 @@ import {
   type ShareRecord,
   sharePasswordSchema,
 } from '@/lib/api/contracts/public-shares'
-import {
-  admitContent,
-  ContentRefusedError,
-  isCopilotPrincipal,
-} from '@/lib/core/application/content-delivery'
+import { admitContent, ContentRefusedError, isCopilotPrincipal } from '@/lib/core/application'
 import { resolveCopilotSecretReference } from '@/lib/core/application/environment-reference'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { parseExactEnvironmentReference } from '@/lib/environment/reference'
diff --git a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
index d9f486f5539..1b84b8f1a9e 100644
--- a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
@@ -1,7 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
-import { admitContent } from '@/lib/core/application/content-delivery'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   ContentVersionConflictError,

From f67d81ca2dab00ae5b601e5e2b00edaf814dbc20 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 18:10:23 -0700
Subject: [PATCH 11/13] fix(mothership): preserve content revisions and archive
 budgets

---
 .../content-delivery.integration.ts           | 79 +++++++++++++++++++
 .../read-original-document.test.ts            |  5 ++
 .../application/read-original-document.ts     |  3 +-
 .../content-delivery.integration.ts           | 55 ++++++++++++-
 .../download-workspace-file-items.ts          | 23 +++---
 scripts/check-unused-exports.baseline.json    |  1 -
 6 files changed, 154 insertions(+), 12 deletions(-)

diff --git a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
index dd68726e3b4..33f44ead783 100644
--- a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
@@ -1,4 +1,8 @@
 /** Real PostgreSQL content admission, pagination, captured metadata, and streamed ZIP readback. */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 import * as audit from '@sim/audit'
 import { db } from '@sim/db'
 import {
@@ -18,6 +22,14 @@ import { eq, inArray } from 'drizzle-orm'
 import { PostgresJsPreparedQuery } from 'drizzle-orm/postgres-js/session'
 import JSZip from 'jszip'
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+
 import { observeContentDelivery } from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
@@ -28,11 +40,13 @@ import {
 import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
 import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import * as knowledgeContexts from '@/lib/knowledge/application/contexts'
 import { listKnowledgeDocuments } from '@/lib/knowledge/application/documents'
 import {
   exportKnowledgeBase,
   type KnowledgeBaseExportBundle,
 } from '@/lib/knowledge/application/exports'
+import { readOriginalKnowledgeDocument } from '@/lib/knowledge/application/read-original-document'
 import {
   readDetailedKnowledgeTagUsage,
   readKnowledgeTagUsage,
@@ -48,6 +62,7 @@ import { buildKnowledgeBundleArchive } from '@/lib/knowledge/transfer/export-arc
 import { embeddingVectorValues } from '@/lib/knowledge/vector-columns'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { uploadFile } from '@/lib/uploads/core/storage-service'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 const SECRET = 'fixture-knowledge-token-41875'
@@ -173,6 +188,7 @@ async function drainAudits() {
 }
 
 beforeAll(async () => {
+  fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-knowledge-delivery-'))
   await seedKnowledgeAclFixture(ids)
   const record = audit.recordAudit
   vi.spyOn(audit, 'recordAudit').mockImplementation((entry) => {
@@ -208,6 +224,7 @@ afterAll(async () => {
   await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
   await db.delete(organization).where(eq(organization.id, ids.organizationId))
   await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  await rm(fixtureStorage.root, { recursive: true, force: true })
   await db.$client.end()
 })
 
@@ -444,6 +461,68 @@ describe('knowledge content delivery', () => {
     }
   )
 
+  it('binds an original read to the captured storage key across a concurrent replacement', async () => {
+    const doc = await seedDocument({ original: false, content: SECRET, provenance: exact })
+    const oldKey = `kb/${generateId()}.txt`
+    const newKey = `kb/${generateId()}.txt`
+    for (const [key, content] of [
+      [oldKey, SECRET],
+      [newKey, 'replacement public content'],
+    ]) {
+      await uploadFile({
+        file: Buffer.from(content),
+        fileName: 'fixture.txt',
+        contentType: 'text/plain',
+        context: 'knowledge-base',
+        customKey: key,
+        preserveKey: true,
+        persistMetadata: false,
+      })
+    }
+    await db.update(document).set({ storageKey: oldKey }).where(eq(document.id, doc.id))
+    const input = {
+      knowledgeBaseId: ids.knowledgeBaseId,
+      documentId: doc.id,
+      assertedWorkspaceId: ids.workspaceId,
+    }
+    const matched = await inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+    expect(matched.buffer?.toString()).toBe(SECRET)
+    expect(matched.hasRecordedSecrets).toBe(true)
+    const resolve = knowledgeContexts.resolveCanonicalActiveKnowledgeDocumentContext
+    let replaced = false
+    const interleave = vi
+      .spyOn(knowledgeContexts, 'resolveCanonicalActiveKnowledgeDocumentContext')
+      .mockImplementation(async (...args) => {
+        const context = await resolve(...args)
+        await db.transaction(async (tx) => {
+          const [row] = await tx
+            .update(document)
+            .set({ storageKey: newKey })
+            .where(eq(document.id, doc.id))
+            .returning()
+          await replaceKnowledgeDocumentSecretProvenanceInTx(
+            tx,
+            doc.id,
+            createKnowledgeDocumentSourceValue(row),
+            { status: 'exact', entries: [] }
+          )
+        })
+        replaced = true
+        return context
+      })
+    try {
+      await expect(
+        inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+      ).rejects.toThrow(/provenance|model/i)
+      expect(replaced).toBe(true)
+    } finally {
+      interleave.mockRestore()
+    }
+    const current = await inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+    expect(current.buffer?.toString()).toBe('replacement public content')
+    expect(current.hasRecordedSecrets).toBe(false)
+  })
+
   it('exports clean and legacy originals with chunks through the existing ZIP stream', async () => {
     const docs = [
       await seedDocument(),
diff --git a/apps/sim/lib/knowledge/application/read-original-document.test.ts b/apps/sim/lib/knowledge/application/read-original-document.test.ts
index 97c2d393719..9df9cc92ba4 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.test.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.test.ts
@@ -89,6 +89,7 @@ describe('original knowledge document read', () => {
     )
     workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('read')
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: document.filename, fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [] },
     })
@@ -104,6 +105,7 @@ describe('original knowledge document read', () => {
       },
     })
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: document.filename, fileUrl: 'https://example.test/private' },
       provenance: { status: 'exact', entries: [] },
     })
@@ -144,6 +146,7 @@ describe('original knowledge document read', () => {
     'refuses Chat an original its gate refuses, before reading it: %j',
     async (provenance) => {
       mocks.provenance.mockResolvedValue({
+        storageKey: document.storageKey,
         source: { filename: document.filename, fileUrl: document.fileUrl },
         provenance,
       })
@@ -156,6 +159,7 @@ describe('original knowledge document read', () => {
   })
   it('classifies a concurrent source replacement as unknown, refusing it before reading', async () => {
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: 'changed', fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [] },
     })
@@ -164,6 +168,7 @@ describe('original knowledge document read', () => {
   })
   it('reads for a caller outside Chat without classifying, flagging recorded secrets', async () => {
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: document.filename, fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [{ secret: 'private' }] },
     })
diff --git a/apps/sim/lib/knowledge/application/read-original-document.ts b/apps/sim/lib/knowledge/application/read-original-document.ts
index 74e21f285a5..40c99c5038b 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.ts
@@ -53,8 +53,9 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
       )
     const snapshot = await loadKnowledgeDocumentDurableSecretProvenance(doc.id)
     const provenance =
+      snapshot.storageKey === doc.storageKey &&
       hashDurableSecretProvenanceValue(snapshot.source) ===
-      hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc))
+        hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc))
         ? snapshot.provenance
         : ({ status: 'unknown' } as const)
     await requireAdmittedContent(principal, {
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 88ac4d923b1..36a0f3a2d42 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -103,6 +103,7 @@ import {
   userTableRowSecretProvenance,
   workflowTest,
   workspaceFileSearchRevision,
+  workspaceFiles,
 } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
 import { eq, sql } from 'drizzle-orm'
@@ -210,11 +211,18 @@ function noteExercised(method: string, route: string) {
 }
 
 describe('content reaching Chat is admitted per item', () => {
+  let redis: NonNullable<ReturnType<typeof getRedisClient>>
   let fixture: ContentFixture
   let connector: { connectorId: string; documentId: string }
 
   beforeAll(async () => {
     fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-delivery-'))
+    const client = getRedisClient()
+    if (!client)
+      throw new Error(
+        'Set TEST_REDIS_URL to a disposable local Redis or use bun run test:integration'
+      )
+    redis = client
     // Compile the lazy tool graph before request deadlines and per-case provider fixtures exist.
     await matchV2Route('/api/v2/tools/file_get_content/execute')?.load()
     fixture = await seedContentFixture()
@@ -273,7 +281,7 @@ describe('content reaching Chat is admitted per item', () => {
       workspaceId: fixture.ids.workspaceId,
       type: 'mothership',
     })
-    await getRedisClient()?.set(
+    await redis.set(
       `mothership:sandbox-resources:${token}:context`,
       JSON.stringify({
         toolCallId: generateId(),
@@ -608,6 +616,51 @@ describe('content reaching Chat is admitted per item', () => {
       expect(refused.body).not.toContain('gamma')
     })
 
+    it.each(['clean', 'entries'] as const)(
+      'applies the archive declared-size budget after %s contributor admission',
+      async (kind) => {
+        const input = await getWorkspaceFile(ws(), fixture.files[kind], { throwOnError: true })
+        if (!input) throw new Error('Missing archive contributor fixture')
+        const source = `await getFileBase64('${input.id}'); pdf.addPage().drawText('fixture render');`
+        const documentIds: string[] = []
+        for (let index = 0; index < (kind === 'clean' ? 6 : 5); index += 1) {
+          const doc = await uploadWorkspaceFile(
+            ws(),
+            fixture.ids.aliceId,
+            Buffer.from(
+              index === 5 ? 'throw new Error("archive budget checked too late")' : source
+            ),
+            `archive-budget-${generateId()}.pdf`,
+            'text/x-python-pdf',
+            {
+              notifyWorkspaceChange: false,
+              secretProvenance: { status: 'exact', entries: [] },
+            }
+          )
+          // Declared source sizes exercise aggregate accounting without large fixture allocations.
+          await db
+            .update(workspaceFiles)
+            .set({ sizeBytes: 50 * 1024 * 1024 })
+            .where(eq(workspaceFiles.id, doc.id))
+          documentIds.push(doc.id)
+        }
+        const result = await cli(
+          'GET',
+          `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${fixture.files.clean},${documentIds}`
+        )
+        if (kind === 'clean') {
+          expect(result.status, result.body).toBe(400)
+          expect(result.body).toMatch(/download limit/i)
+        } else {
+          expect(result.status, result.body).toBe(200)
+          expect(result.body).toContain(CANARY.clean)
+          expect(result.body).toContain('sim-download-report.json')
+          for (const id of documentIds) expect(result.body).toContain(id)
+          expect(result.body).not.toContain('%PDF-1.7')
+        }
+      }
+    )
+
     it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {
       const share = (fileId: string) =>
         cli('PATCH', `/api/v2/files/${fileId}/share`, {
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index 32976b7be39..d3d908b456a 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -31,7 +31,7 @@ import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { parseWorkspaceFileFolderDisplayPath } from '@/lib/workspace-files/folder-display-path'
 import { MAX_ZIP_DOWNLOAD_FILES } from '@/lib/workspace-files/limits'
 
-export const MAX_ZIP_DOWNLOAD_BYTES = 250 * 1024 * 1024
+const MAX_ZIP_DOWNLOAD_BYTES = 250 * 1024 * 1024
 const MAX_REQUESTED_FILE_IDS = 1_000
 const MAX_REQUESTED_FOLDER_IDS = 1_000
 
@@ -104,6 +104,14 @@ function validationError(message: string): never {
   throw new OrchestrationError('validation', message)
 }
 
+function validateDeclaredBytes(bytes: number): void {
+  if (bytes > MAX_ZIP_DOWNLOAD_BYTES) {
+    validationError(
+      `Selected files total ${formatFileSize(bytes)}, which exceeds the ${formatFileSize(MAX_ZIP_DOWNLOAD_BYTES)} download limit.`
+    )
+  }
+}
+
 async function executeDownloadWorkspaceFileItems({
   input,
   context,
@@ -183,16 +191,11 @@ async function executeDownloadWorkspaceFileItems({
     'opaque'
   )
 
-  const declaredBytes = filesToZip.reduce((sum, file) => sum + file.size, 0)
-  if (declaredBytes > MAX_ZIP_DOWNLOAD_BYTES) {
-    validationError(
-      `Selected files total ${formatFileSize(declaredBytes)}, which exceeds the ${formatFileSize(MAX_ZIP_DOWNLOAD_BYTES)} download limit.`
-    )
-  }
-
   const reservedForStreamed = filesToZip
     .filter((file) => !needsRenderedArtifact(file.type, file.name))
     .reduce((sum, file) => sum + file.size, 0)
+  let declaredBytes = reservedForStreamed
+  validateDeclaredBytes(declaredBytes)
   const renderedDocuments = new Map<string, Buffer>()
   const pendingNames: string[] = []
   let renderedBytes = 0
@@ -211,6 +214,8 @@ async function executeDownloadWorkspaceFileItems({
         filesToZip = filesToZip.filter((admitted) => admitted.id !== file.id)
         continue
       }
+      declaredBytes += file.size
+      validateDeclaredBytes(declaredBytes)
       renderedBytes += buffer.length
       renderedDocuments.set(file.id, buffer)
     } catch (error) {
@@ -240,7 +245,7 @@ async function executeDownloadWorkspaceFileItems({
     folderPaths,
     renderedDocuments,
     /** Counted over what is zipped, after any rendered document whose contributors were refused. */
-    declaredBytes: filesToZip.reduce((sum, file) => sum + file.size, 0),
+    declaredBytes,
   }
 }
 
diff --git a/scripts/check-unused-exports.baseline.json b/scripts/check-unused-exports.baseline.json
index becb5744f4c..0a790dc3e64 100644
--- a/scripts/check-unused-exports.baseline.json
+++ b/scripts/check-unused-exports.baseline.json
@@ -5280,7 +5280,6 @@
   "apps/sim/lib/workspace-events/constants.ts#SIM_RULE_EVENT_TYPES",
   "apps/sim/lib/workspace-files/application/csv-preview-workspace-file.ts#CsvPreviewWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/delete-workspace-file.ts#DeleteWorkspaceFileInput",
-  "apps/sim/lib/workspace-files/application/download-workspace-file-items.ts#MAX_ZIP_DOWNLOAD_BYTES",
   "apps/sim/lib/workspace-files/application/download-workspace-file.ts#DownloadWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/extract-workspace-file.ts#ExtractWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/extract-workspace-file.ts#ExtractWorkspaceFileResult",

From d5b9e486cd96496d6d8e9cae3e4c730f5350f157 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 18:39:56 -0700
Subject: [PATCH 12/13] fix(mothership): preserve partial downloads during
 compilation

---
 apps/sim/lib/execution/sandbox/run-task.ts    | 13 ++++-
 .../content-delivery.integration.ts           | 54 +++++++++++++++++++
 .../download-workspace-file-items.ts          |  4 ++
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/apps/sim/lib/execution/sandbox/run-task.ts b/apps/sim/lib/execution/sandbox/run-task.ts
index 38f3edad77d..3b1b088b254 100644
--- a/apps/sim/lib/execution/sandbox/run-task.ts
+++ b/apps/sim/lib/execution/sandbox/run-task.ts
@@ -1,6 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
+import { ContentRefusedError } from '@/lib/core/application'
 import {
   executeInIsolatedVM,
   type IsolatedVMBrokerHandler,
@@ -65,8 +66,16 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
   }
   const brokers: Record<string, IsolatedVMBrokerHandler> = {}
   const runInCallerContext = AsyncLocalStorage.snapshot()
+  let brokerRefusal: ContentRefusedError | undefined
   for (const broker of task.brokers) {
-    brokers[broker.name] = (args) => runInCallerContext(() => broker.handle(brokerContext, args))
+    brokers[broker.name] = async (args) => {
+      try {
+        return await runInCallerContext(() => broker.handle(brokerContext, args))
+      } catch (error) {
+        if (error instanceof ContentRefusedError) brokerRefusal = error
+        throw error
+      }
+    }
   }
 
   const request: IsolatedVMExecutionRequest = {
@@ -124,6 +133,8 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
       if (result.error.stack) err.stack = result.error.stack
       throw err
     }
+    // IPC carries strings; retain a matching host refusal without reclassifying user-thrown errors.
+    if (brokerRefusal && result.error.message === brokerRefusal.message) throw brokerRefusal
     throw new SandboxUserCodeError(
       result.error.message,
       result.error.name || 'SandboxTaskError',
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index 36a0f3a2d42..de40976ba29 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -149,6 +149,7 @@ import {
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 import {
   getWorkspaceFileShares,
@@ -431,6 +432,59 @@ describe('content reaching Chat is admitted per item', () => {
       expect(read.body).toContain(fixture.files.entries)
     })
 
+    it.each(['uncached', 'cached', 'recovered', 'user-error', 'subsequent-error'] as const)(
+      'keeps generated-document refusals per item (%s archive)',
+      async (kind) => {
+        const input = fixture.files.unknown
+        const read = `await getFileBase64('${input}');`
+        const code =
+          kind === 'recovered'
+            ? `try { ${read} } catch {} pdf.addPage().drawText('safe fallback');`
+            : kind === 'user-error'
+              ? `const error = new Error('File cannot be sent to a model because its secret provenance is unavailable'); error.name = 'ContentRefusedError'; throw error;`
+              : kind === 'subsequent-error'
+                ? `try { ${read} } catch {} throw new Error('fixture compiler failure');`
+                : `${read} pdf.addPage().drawText('fixture render');`
+        const document = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(`const archiveFixture = '${generateId()}'; ${code}`),
+          `archive-refusal-${generateId()}.pdf`,
+          'text/x-python-pdf',
+          { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
+        )
+        if (kind === 'cached') {
+          const warmed = await downloadWorkspaceFileItems.execute({
+            principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
+            input: { workspaceId: ws(), fileIds: [document.id], folderIds: [] },
+          })
+          expect(warmed.renderedDocuments.get(document.id)?.subarray(0, 4).toString()).toBe('%PDF')
+        }
+        const route = `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=`
+        const mixed = await cli('GET', `${route}${fixture.files.clean},${document.id}`)
+        if (kind === 'user-error' || kind === 'subsequent-error') {
+          expect(mixed.status).toBe(500)
+          expect(mixed.body).toContain('INTERNAL_ERROR')
+          return
+        }
+        expect(mixed.status, mixed.body).toBe(200)
+        expect(mixed.body).toContain(CANARY.clean)
+        expect(mixed.body).not.toContain(CANARY.unknown)
+        expect(mixed.registry.isPermanentlyIncomplete()).toBe(false)
+        if (kind === 'recovered') {
+          expect(mixed.body).toContain('%PDF')
+          expect(mixed.body).not.toContain('sim-download-report.json')
+        } else {
+          expect(mixed.body).not.toContain('%PDF')
+          expect(mixed.body).toContain('sim-download-report.json')
+          expect(mixed.body).toContain(document.id)
+          const alone = await cli('GET', `${route}${document.id}`)
+          expect(alone.status, alone.body).toBe(403)
+          expect(alone.body).not.toContain(CANARY.unknown)
+        }
+      }
+    )
+
     it('answers files search with locations and withheld unreadable previews (#5, misroute)', async () => {
       const read = await cli(
         'GET',
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index d3d908b456a..b5ef60ad4af 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -219,6 +219,10 @@ async function executeDownloadWorkspaceFileItems({
       renderedBytes += buffer.length
       renderedDocuments.set(file.id, buffer)
     } catch (error) {
+      if (error instanceof ContentRefusedError) {
+        filesToZip = filesToZip.filter((admitted) => admitted.id !== file.id)
+        continue
+      }
       if (error instanceof PayloadSizeLimitError) {
         validationError(
           allowance === MAX_RENDERED_DOCUMENT_BYTES

From 0fed0792d3eaea86f0c300d1808969fb3537fdf6 Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyath@simstudio.ai>
Date: Tue, 13 Oct 2026 19:08:14 -0700
Subject: [PATCH 13/13] fix(sandbox): preserve broker error identity

---
 apps/sim/lib/execution/isolated-vm-worker.cjs |  27 ++++-
 apps/sim/lib/execution/isolated-vm.ts         |   6 +-
 apps/sim/lib/execution/sandbox/run-task.ts    |  16 ++-
 .../content-delivery.integration.ts           | 111 ++++++++++--------
 4 files changed, 98 insertions(+), 62 deletions(-)

diff --git a/apps/sim/lib/execution/isolated-vm-worker.cjs b/apps/sim/lib/execution/isolated-vm-worker.cjs
index 4d2ff9ce5f8..c947ad4abe8 100644
--- a/apps/sim/lib/execution/isolated-vm-worker.cjs
+++ b/apps/sim/lib/execution/isolated-vm-worker.cjs
@@ -951,6 +951,11 @@ async function executeTask(request, executionId) {
         // Capture the bridge reference in a closure so hardening can unset the
         // global without breaking already-installed brokers.
         const __ref = globalThis.__brokerRef;
+        const __brokerErrors = new WeakMap();
+        const __rememberBrokerError = __brokerErrors.set.bind(__brokerErrors);
+        Object.defineProperty(globalThis, '__readBrokerErrorId', {
+          value: __brokerErrors.get.bind(__brokerErrors), writable: false, configurable: false
+        });
         globalThis.__brokers = globalThis.__brokers || {};
         for (const name of ${brokerNamesJson}) {
           globalThis.__brokers[name] = async (args) => {
@@ -963,7 +968,9 @@ async function executeTask(request, executionId) {
             let response;
             try { response = JSON.parse(responseJson); } catch { throw new Error('Invalid broker response'); }
             if (typeof response.error === 'string') {
-              throw new Error(response.error || 'Broker call failed');
+              const error = new Error(response.error || 'Broker call failed');
+              __rememberBrokerError(error, response.brokerErrorId);
+              throw error;
             }
             return response.resultJson === undefined || response.resultJson === null
               ? null
@@ -1016,7 +1023,7 @@ async function executeTask(request, executionId) {
       userResult = { success: true }
     } else {
       const wrappedUserCode = `
-      (async () => {
+      (async () => { const __readBrokerErrorId = globalThis.__readBrokerErrorId;
         try {
           await (async () => {
             ${code}
@@ -1029,6 +1036,7 @@ async function executeTask(request, executionId) {
               message: error && error.message ? error.message : String(error),
               name: error && error.name ? error.name : 'Error',
               stack: error && error.stack ? error.stack : '',
+              brokerErrorId: __readBrokerErrorId(error),
             },
           });
         }
@@ -1056,7 +1064,12 @@ async function executeTask(request, executionId) {
       return {
         result: null,
         stdout: stdoutChunks.join(''),
-        error: convertToCompatibleError(userResult.errorInfo, code),
+        error: {
+          ...convertToCompatibleError(userResult.errorInfo, code),
+          ...(Number.isSafeInteger(userResult.errorInfo.brokerErrorId)
+            ? { brokerErrorId: userResult.errorInfo.brokerErrorId }
+            : {}),
+        },
         timings,
       }
     }
@@ -1233,7 +1246,13 @@ process.on('message', async (msg) => {
       if (pending) {
         clearTimeout(pending.timeout)
         pendingBrokerCalls.delete(msg.brokerId)
-        pending.resolve(JSON.stringify({ error: msg.error, resultJson: msg.resultJson }))
+        pending.resolve(
+          JSON.stringify({
+            error: msg.error,
+            resultJson: msg.resultJson,
+            ...(typeof msg.error === 'string' ? { brokerErrorId: msg.brokerId } : {}),
+          })
+        )
       }
     }
   } catch (err) {
diff --git a/apps/sim/lib/execution/isolated-vm.ts b/apps/sim/lib/execution/isolated-vm.ts
index 8292b05beba..936186f9455 100644
--- a/apps/sim/lib/execution/isolated-vm.ts
+++ b/apps/sim/lib/execution/isolated-vm.ts
@@ -66,7 +66,7 @@ interface IsolatedVMTaskRequest {
  * Host-side broker handler invoked when isolate code calls a broker.
  * Registered per-request via `executeInIsolatedVM(..., { brokers })`.
  */
-export type IsolatedVMBrokerHandler = (args: unknown) => Promise<unknown>
+export type IsolatedVMBrokerHandler = (args: unknown, brokerId: number) => Promise<unknown>
 
 export interface IsolatedVMExecutionOptions {
   /** Broker name → handler. Must cover every broker listed in `request.task.brokers`. */
@@ -104,6 +104,8 @@ interface IsolatedVMTaskTimings {
 }
 
 interface IsolatedVMError {
+  /** Existing broker call ID, set only when a task propagates that broker's error object. */
+  brokerErrorId?: number
   message: string
   name: string
   stack?: string
@@ -735,7 +737,7 @@ function handleBrokerMessage(
   }
 
   Promise.resolve()
-    .then(() => pending.runInOutboundScope(() => handler(args)))
+    .then(() => pending.runInOutboundScope(() => handler(args, brokerId)))
     .then((resultValue) => {
       if (pending.cancelled) {
         sendResponse({ error: 'Execution cancelled' })
diff --git a/apps/sim/lib/execution/sandbox/run-task.ts b/apps/sim/lib/execution/sandbox/run-task.ts
index 3b1b088b254..7e09020b196 100644
--- a/apps/sim/lib/execution/sandbox/run-task.ts
+++ b/apps/sim/lib/execution/sandbox/run-task.ts
@@ -66,13 +66,16 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
   }
   const brokers: Record<string, IsolatedVMBrokerHandler> = {}
   const runInCallerContext = AsyncLocalStorage.snapshot()
-  let brokerRefusal: ContentRefusedError | undefined
+  let brokerRefusals: Map<number, ContentRefusedError> | undefined
   for (const broker of task.brokers) {
-    brokers[broker.name] = async (args) => {
+    brokers[broker.name] = async (args, brokerId) => {
       try {
         return await runInCallerContext(() => broker.handle(brokerContext, args))
       } catch (error) {
-        if (error instanceof ContentRefusedError) brokerRefusal = error
+        if (error instanceof ContentRefusedError) {
+          brokerRefusals ??= new Map()
+          brokerRefusals.set(brokerId, error)
+        }
         throw error
       }
     }
@@ -133,8 +136,11 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
       if (result.error.stack) err.stack = result.error.stack
       throw err
     }
-    // IPC carries strings; retain a matching host refusal without reclassifying user-thrown errors.
-    if (brokerRefusal && result.error.message === brokerRefusal.message) throw brokerRefusal
+    const brokerRefusal =
+      result.error.brokerErrorId === undefined
+        ? undefined
+        : brokerRefusals?.get(result.error.brokerErrorId)
+    if (brokerRefusal) throw brokerRefusal
     throw new SandboxUserCodeError(
       result.error.message,
       result.error.name || 'SandboxTaskError',
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
index de40976ba29..3eff379a761 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -432,58 +432,67 @@ describe('content reaching Chat is admitted per item', () => {
       expect(read.body).toContain(fixture.files.entries)
     })
 
-    it.each(['uncached', 'cached', 'recovered', 'user-error', 'subsequent-error'] as const)(
-      'keeps generated-document refusals per item (%s archive)',
-      async (kind) => {
-        const input = fixture.files.unknown
-        const read = `await getFileBase64('${input}');`
-        const code =
-          kind === 'recovered'
-            ? `try { ${read} } catch {} pdf.addPage().drawText('safe fallback');`
-            : kind === 'user-error'
-              ? `const error = new Error('File cannot be sent to a model because its secret provenance is unavailable'); error.name = 'ContentRefusedError'; throw error;`
-              : kind === 'subsequent-error'
-                ? `try { ${read} } catch {} throw new Error('fixture compiler failure');`
-                : `${read} pdf.addPage().drawText('fixture render');`
-        const document = await uploadWorkspaceFile(
-          ws(),
-          fixture.ids.aliceId,
-          Buffer.from(`const archiveFixture = '${generateId()}'; ${code}`),
-          `archive-refusal-${generateId()}.pdf`,
-          'text/x-python-pdf',
-          { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
-        )
-        if (kind === 'cached') {
-          const warmed = await downloadWorkspaceFileItems.execute({
-            principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
-            input: { workspaceId: ws(), fileIds: [document.id], folderIds: [] },
-          })
-          expect(warmed.renderedDocuments.get(document.id)?.subarray(0, 4).toString()).toBe('%PDF')
-        }
-        const route = `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=`
-        const mixed = await cli('GET', `${route}${fixture.files.clean},${document.id}`)
-        if (kind === 'user-error' || kind === 'subsequent-error') {
-          expect(mixed.status).toBe(500)
-          expect(mixed.body).toContain('INTERNAL_ERROR')
-          return
-        }
-        expect(mixed.status, mixed.body).toBe(200)
-        expect(mixed.body).toContain(CANARY.clean)
-        expect(mixed.body).not.toContain(CANARY.unknown)
-        expect(mixed.registry.isPermanentlyIncomplete()).toBe(false)
-        if (kind === 'recovered') {
-          expect(mixed.body).toContain('%PDF')
-          expect(mixed.body).not.toContain('sim-download-report.json')
-        } else {
-          expect(mixed.body).not.toContain('%PDF')
-          expect(mixed.body).toContain('sim-download-report.json')
-          expect(mixed.body).toContain(document.id)
-          const alone = await cli('GET', `${route}${document.id}`)
-          expect(alone.status, alone.body).toBe(403)
-          expect(alone.body).not.toContain(CANARY.unknown)
-        }
+    it.each([
+      'uncached',
+      'cached',
+      'recovered',
+      'user-error',
+      'subsequent-error',
+      'copied-error',
+      'mutated-refusal',
+    ] as const)('keeps generated-document refusals per item (%s archive)', async (kind) => {
+      const input = fixture.files.unknown
+      const read = `await getFileBase64('${input}');`
+      const code =
+        kind === 'recovered'
+          ? `try { ${read} } catch {} pdf.addPage().drawText('safe fallback');`
+          : kind === 'user-error'
+            ? `const error = new Error('File cannot be sent to a model because its secret provenance is unavailable'); error.name = 'ContentRefusedError'; throw error;`
+            : kind === 'subsequent-error'
+              ? `try { ${read} } catch {} throw new Error('fixture compiler failure');`
+              : kind === 'copied-error'
+                ? `try { ${read} } catch (error) { throw Object.assign(new Error(error.message), error); }`
+                : kind === 'mutated-refusal'
+                  ? `try { ${read} } catch (error) { error.message = 'fixture reworded refusal'; throw error; }`
+                  : `${read} pdf.addPage().drawText('fixture render');`
+      const document = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`const archiveFixture = '${generateId()}'; ${code}`),
+        `archive-refusal-${generateId()}.pdf`,
+        'text/x-python-pdf',
+        { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
+      )
+      if (kind === 'cached') {
+        const warmed = await downloadWorkspaceFileItems.execute({
+          principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
+          input: { workspaceId: ws(), fileIds: [document.id], folderIds: [] },
+        })
+        expect(warmed.renderedDocuments.get(document.id)?.subarray(0, 4).toString()).toBe('%PDF')
       }
-    )
+      const route = `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=`
+      const mixed = await cli('GET', `${route}${fixture.files.clean},${document.id}`)
+      if (kind === 'user-error' || kind === 'subsequent-error' || kind === 'copied-error') {
+        expect(mixed.status).toBe(500)
+        expect(mixed.body).toContain('INTERNAL_ERROR')
+        return
+      }
+      expect(mixed.status, mixed.body).toBe(200)
+      expect(mixed.body).toContain(CANARY.clean)
+      expect(mixed.body).not.toContain(CANARY.unknown)
+      expect(mixed.registry.isPermanentlyIncomplete()).toBe(false)
+      if (kind === 'recovered') {
+        expect(mixed.body).toContain('%PDF')
+        expect(mixed.body).not.toContain('sim-download-report.json')
+      } else {
+        expect(mixed.body).not.toContain('%PDF')
+        expect(mixed.body).toContain('sim-download-report.json')
+        expect(mixed.body).toContain(document.id)
+        const alone = await cli('GET', `${route}${document.id}`)
+        expect(alone.status, alone.body).toBe(403)
+        expect(alone.body).not.toContain(CANARY.unknown)
+      }
+    })
 
     it('answers files search with locations and withheld unreadable previews (#5, misroute)', async () => {
       const read = await cli(