feat(project-files): add rendered delivery and indexed search

[mzxchandra]

Summary

• Add authorized Project file rendering, inline content, previews, and indexed search.
• Recheck current owner access, source revisions, and embedded-file identities before delivering rendered bytes. Preserve provenance and invalidate compiled artifacts when their inputs change.
• Apply opaque/excerpt admission before reading and after revalidation; withhold stale search previews. Failed reads preserve shared deterministic render caches.
• Rebase the rendering/search slice onto staging after feat(project-files): add core storage and realtime operations #9016, retaining streaming source downloads and buffered previews. Keep Project API/CLI documentation unpublished until launch.

Type of Change

• Feature / refactor

Testing

• Latest repair: 85 focused database integration checks and 66 unit tests passed, covering observer refusal, private CLI provenance round trips, registry admission, and HEAD without compilation. Earlier focused delivery/search/cache checks also passed.
• Prior real-app delivery/rendering run: 15 checks passed, including browser cache reuse, authenticated HEAD, DOCX/PPTX/PDF rendering, asset-revision cache invalidation, and foreign/archived dependency rejection.
• Scoped type check introduced no errors beyond the existing test baseline. Scoped formatting and strict API validation passed.
• Pre-deployment source fixtures prepared and verified; post-deployment staging validation remains pending. Full repository checks run in hosted CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Focused tests added/updated and passing
• No new warnings introduced
• Full hosted CI passed
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Review stack

#9015 and #9016 are merged. This PR contains only rendering/search and targets staging. #9018 adds bulk transfers; #9019 adds sharing. Rebase each following slice after its parent merges. #8610 is superseded by this stack.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 15, 2026 12:36am UTC

[mzxchandra]

@greptile

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge based on the reviewed changes.

Summary

Adds authorized Project file rendering, inline delivery, CSV previews, and indexed search.

• Project files can be delivered as rendered documents and image previews.
• Project inline files and CSV previews use owner-checked routes.
• Project file search returns matches with index coverage.
• Embedded file links resolve under their Project or workspace owner.
• Workspace file delivery rechecks access and revisions before sending bytes.
• Workbench downloads keep file provenance without exposing opaque bytes to the model.
• Build checks and sandbox support change without altering file behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[File request] --> B[Check current access]
  B --> C[Read source and identify inputs]
  C --> D[Read authorized inputs]
  D --> E[Render or reuse cached bytes]
  E --> F[Recheck access and file revisions]
  F --> G[Check content admission]
  G --> H[Return bytes and provenance]

Loading

_{Reviews (5) · Last reviewed commit: "test(files): guard required document for..." · Reviewed by Greptile}

[mzxchandra]

@greptile

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 80 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[mzxchandra]

@greptile

[cubic-dev-ai]

All reported issues were addressed across 89 files

<sub>You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic</sub>

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[mzxchandra]

@greptile

[cubic-dev-ai]

No issues found across 89 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[mzxchandra]

Staging validation (October 14) passed for exercised Workspace paths. Initial checks used verified serving release 2916f4abf16b; the race follow-up used verified descendant 96ab45ec55b8, including later staging changes. Traffic/deployment and running image identity were checked independently of CI.

Existing text/Markdown/CSV bytes, metadata and original version history were preserved. Markdown rendering, CSV preview, download MIME/filenames, bodyless HEAD, unauthenticated denial, and same-owner inline-image rendering passed; a mismatched-owner reference did not render.

Workspace race follow-up: during deliberately delayed DOCX generation, a source replacement and an embedded-image replacement each committed before delivery and produced 409 (file changed while preparing download). Archiving during generation produced 404. No document bytes were delivered in these cases. Fresh renders succeeded afterward; the dependency render contained the exact replacement image bytes. The archived synthetic fixture was restored, original fixture hashes still match, and all fixtures are retained. No roles or flags changed.

Projects remains disabled. Membership-revocation races, authorization after response publication, other generated/export formats, Project-enabled rendering/search, real foreign-owner asset denial, secret-provenance paths, and production remain untested. The mismatched-reference smoke check is narrower than server-side cross-owner authorization coverage.