fix(memory): read memory records and their provenance in one statement

[waleedlatif1]

Summary

• Memory list, read, and the append readback read each record and then its provenance sidecar in a separate query. An append committing between the two paired the old record with the new sidecar's hash, so the read came back as unknown provenance and the whole tool result was withheld (e.g. memory get all from an Agent block while another run writes memory)
• Read the record and its sidecar in one LEFT JOIN statement, the way the prefix reader already did, and drop the second query
• Share one MEMORY_SECRET_PROVENANCE_COLUMNS set (named to match readBoundMemorySecretProvenance) across the list/read reader, the prefix reader and the Agent memory handler, removing the hand-written field mapping
• Billing scope still resolves before any provenance is classified; no policy, schema, or limit changes

Type of Change

• Bug fix

Testing

• New integration cases commit an append between the reads for list, read, and append readback: all three return unknown on the old reader and exact on this one
• Memory integration suites, full app unit suite, type-check, lint, and audits pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 18, 2026 10:02pm UTC

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

Memory reads now fetch each record and its secret-source details in one database statement. This prevents concurrent writes from pairing an older record with newer source details.

• Memory reads keep each record paired with its provenance.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[List, read, or append readback] --> B[Read record and sidecar together]
  B --> C[Resolve billing scope]
  C --> D[Check cancellation]
  D --> E[Check provenance and read any tail]
  E --> F[Return public records and private provenance]

Loading

_{Reviews (2) · Last reviewed commit: "fix(memory): stop cancelled memory reads..." · Reviewed by Greptile}

[waleedlatif1]

@greptile review

[waleedlatif1]

@cubic-dev-ai review

[cubic-dev-ai]

@cubic-dev-ai review

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}