Skip to content

fix(logs): keep run provenance when compaction drops the execution state - #6528

Merged
waleedlatif1 merged 2 commits into
stagingfrom
fix-trace-provenance-blanking
Aug 11, 2026
Merged

fix(logs): keep run provenance when compaction drops the execution state#6528
waleedlatif1 merged 2 commits into
stagingfrom
fix-trace-provenance-blanking

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Store the run's resolved-secret provenance top-level on execution_data so it survives oversized-payload compaction dropping executionState. Without it the display projection can't rebuild its redaction registry and blanks every span's input/output — a truncated run renders as an empty trace.
  • Omit that provenance from both display projections. It holds encrypted secret values and their names, and lifting it top-level would otherwise have exposed it via the logs UI, the v1 API, exports, and external data drains.
  • For rows already truncated before this ships, return the stored spans instead of blanking them — they were projected at write time. Scoped to truncated rows with no provenance; malformed, incomplete, or explicit-null keys still fail closed.

Type of Change

  • Bug fix

Testing

Traced against a real affected execution: the spans and their input/output are present in execution_data but stripped on read. Added mutation-verified unit tests for the write path, all three compaction tiers, the display omit, and each fail-closed case. 466 tests pass in lib/logs.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel

vercel Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Skipped Skipped Aug 11, 2026 3:43am

Request Review

@cursor

cursor Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Medium Risk
Changes secret projection and log read paths where incorrect provenance handling could leak secrets or blank traces; behavior is heavily tested and display paths explicitly omit server-only provenance.

Overview
Fixes truncated execution logs showing empty traces when oversized execution_data compaction drops executionState and the display projection could no longer rebuild its secret redaction registry.

Write path: On completion, the run’s resolvedSecretTraceProvenance is copied to top-level execution_data (from pre-redaction state) so it survives PII redaction and compaction. Minimal compaction keeps that key; the metadata-only tier still drops it when no spans are stored.

Read path: projectExecutionDataForDisplay resolves provenance from the top-level key or executionState, rebuilds the registry for span projection, and never returns provenance to clients (DISPLAY_OMITTED_SERVER_KEYS). For rows truncated before this change (no top-level provenance), stored trace spans are returned as-is when they were already projected at write time; malformed/null provenance still fails closed on span IO and envelope fields.

Reviewed by Cursor Bugbot for commit df73bf0. Configure here.

@greptile-apps

greptile-apps Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR preserves resolved-secret provenance when execution-state compaction occurs while preventing that server-only data from reaching display projections.

  • Stores run provenance at the top level of execution data and retains it through applicable compaction tiers.
  • Omits provenance from legacy and contract-aware display projections.
  • Restores already projected spans for eligible legacy truncated rows while retaining fail-closed handling for malformed provenance.
  • Replaces the previously reported explicit any usages in the new tests with typed views and narrowing.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed
Filename Overview
apps/sim/lib/logs/execution/logger.ts Lifts run provenance before redaction and preserves it through compaction tiers that retain trace content.
apps/sim/lib/logs/execution/trace-store.ts Uses top-level provenance for display redaction, omits server-only fields, and handles eligible historical truncated rows.
apps/sim/lib/logs/types.ts Adds the optional top-level resolved-secret provenance field to the execution-data contract.
apps/sim/lib/logs/execution/logger.test.ts Covers provenance persistence and compaction while replacing the previously flagged introduced any usages.
apps/sim/lib/logs/execution/trace-store.test.ts Covers provenance omission, registry reconstruction, legacy truncation fallback, and fail-closed cases with a typed span helper.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Completed execution] --> B[PII projection]
  B --> C[Top-level run provenance]
  C --> D{Payload oversized?}
  D -->|No| E[Persist full execution data]
  D -->|Yes| F[Compact execution data]
  F --> G[Persist spans and provenance]
  E --> H[Display projection]
  G --> H
  H --> I[Rebuild redaction registry]
  I --> J[Return projected trace]
  H --> K[Omit server-only provenance]
Loading

Reviews (2): Last reviewed commit: "improvement(logs): type the new test hel..." | Re-trigger Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Aug 11, 2026
View reviewed changes
Comment thread apps/sim/lib/logs/execution/logger.test.ts
@waleedlatif1
fix(logs): keep run provenance when compaction drops the execution state
774d3c2 
Oversized-payload compaction drops executionState wholesale but keeps
secretProjectionVersion, so the display projection saw a contract-marked
row it could not verify and returned structural-only spans — blanking
every input and output in the trace.

Store the provenance top-level so it survives compaction, omit it from
both display projections (it carries encrypted secret values and their
names), and let rows truncated before this shipped keep the spans they
were already projected with at write time.
@waleedlatif1
improvement(logs): type the new test helpers instead of using any
df73bf0
@waleedlatif1
waleedlatif1 force-pushed the fix-trace-provenance-blanking branch from 598198c to df73bf0 Compare August 11, 2026 03:43
@waleedlatif1

waleedlatif1 commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review

cursor[bot]
cursor Bot reviewed Aug 11, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit df73bf0. Configure here.

@waleedlatif1
waleedlatif1 merged commit ff64389 into staging Aug 11, 2026
30 checks passed
@waleedlatif1
waleedlatif1 deleted the fix-trace-provenance-blanking branch August 11, 2026 03:50
This was referenced Aug 11, 2026
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@waleedlatif1