fix(knowledge): retain model input provenance - #6540

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 11:35am

PR Summary

Medium Risk
Changes secret provenance handling on the internal knowledge search path; scope is narrow (schema + tests) and aligns with existing provenance contracts, but incorrect parsing could still affect safe projection of secrets in model inputs.

Overview
Fixes a bug where internal Knowledge Search request parsing dropped the optional private model-input provenance envelope, so downstream provenance verification could fail even when the executor sent a valid payload.

internalKnowledgeSearchBodySchema now accepts an optional RESOLVED_SECRET_PROVENANCE_FIELD validated with resolvedSecretTraceProvenanceSchema, matching how other internal route contracts handle secret trace metadata.

Regression tests cover Zod boundary parsing (envelope survives parse) and Knowledge provenance prep after the contract has parsed the body.

^{Reviewed by Cursor Bugbot for commit fff44fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

The PR fixes internal Knowledge Search parsing so authenticated private model-input provenance survives contract validation and reaches downstream provenance verification.

• Adds the resolved-secret provenance envelope to the internal Knowledge Search request schema.
• Adds focused coverage for schema retention and parsed-envelope verification.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The internal schema now preserves the established provenance envelope, and the added tests cover both Zod retention and downstream authenticated provenance preparation without changing authorization or secret-exposure boundaries.

sequenceDiagram
  participant Tool as Internal workflow tool
  participant Transport as Request transport
  participant Contract as Knowledge request contract
  participant Provenance as Provenance verifier
  participant Search as Knowledge search
  Tool->>Transport: Search body + resolved-secret registry
  Transport->>Contract: Header + provenance envelope
  Contract->>Contract: Parse and retain envelope
  Contract->>Provenance: Parsed body and authenticated header
  Provenance->>Search: Verified provenance registry

_{Reviews (1): Last reviewed commit: "fix(knowledge): retain model input prove..." | Re-trigger Greptile}