improvement(provenance): make the incompleteness reason set closed and complete - #6559
Conversation
…d complete The reason a resolved-secret registry latched is the only thing that names which guard tripped, and a refusal surfaces many frames later as one fixed sentence. Two gaps had opened in that set. `workspace-scope-missing` no longer has a producer: the `!context.workspaceId` guard in the copilot table tool went away when `importRowsForModel` was rewritten, and every operation now returns early on a missing workspace before provenance import is reachable. The literal and its warn-classification test case go with it — the test constructed the reason itself, so it asserted on something nothing emits. ResolvedSecretTraceProvenanceAccumulator had no reason concept at all, so its three guards latched anonymously. That matters more there than on the registry: the wire format carries only `complete`, so the consumer can only ever say `source-provenance-incomplete`, and the guard is unrecoverable. Give it the same required `reason` and name all three — a file source with no workspace identity, a workspace file whose sidecar reads unknown, and an MCP tool that timed out. A latch from `record()` stays silent, since it reflects a bundle whose own registry already reported and subflow aggregation runs it per iteration. Fold the error/warn/by-design split into one `reportIncompleteness`. It was copied across both registry latches and would have been copied a third time here, and a copy that can be updated alone lets one reason be a fault in one place and routine in another. Also give the async workflow tool path its own import origin instead of latching with none, and close `UnrecordedDurableProvenanceCause`, which was a free-form string carrying a TSDoc claim that it was always a static literal.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryLow Risk Overview
Also removes the dead Reviewed by Cursor Bugbot for commit ef686fa. Configure here. |
Greptile SummaryThe PR closes and completes provenance-reason types while adding actionable diagnostics for accumulator guards.
Confidence Score: 5/5The PR appears safe to merge with no concrete correctness, security, or compatibility failures identified. The reason-set changes cover all current producers, reporting retains existing classification and suppression behavior, and accumulator provenance remains fail-closed while gaining bounded diagnostics.
|
| Filename | Overview |
|---|---|
| apps/sim/executor/utils/resolved-secret-trace-registry.ts | Centralizes incompleteness reporting, extends the closed reason union, and adds first-guard accumulator diagnostics without changing fail-closed provenance semantics. |
| apps/sim/app/api/mcp/tools/execute/route.ts | Names MCP execution timeouts when they make accumulated provenance incomplete. |
| apps/sim/app/api/tools/file/manage/route.ts | Assigns distinct reasons to unidentified file sources and unknown workspace-file provenance. |
| apps/sim/lib/copilot/request/tools/client.ts | Adds one stable origin to asynchronous workflow provenance import failures and incomplete bundles. |
| apps/sim/lib/execution/durable-secret-provenance-enforcement.ts | Replaces a free-form report cause with a union containing every current production cause. |
| apps/sim/executor/utils/resolved-secret-trace-registry.test.ts | Updates reason classification coverage and verifies first-guard reporting and silent imported-bundle latching. |
Reviews (1): Last reviewed commit: "improvement(provenance): make the incomp..." | Re-trigger Greptile
Summary
workspace-scope-missing— it has no producer. The!context.workspaceIdguard that emitted it disappeared when the copilot table tool'simportRowsForModelwas rewritten, and every operation now returns early on a missing workspace before provenance import is reachable. Its warn-classification test case constructed the reason itself, so it was asserting on something nothing emits.ResolvedSecretTraceProvenanceAccumulatorthe requiredreasonthe registry already has. Its three guards latched anonymously, which matters more here than on the registry: the wire format carries onlycomplete, so the consumer can only ever saysource-provenance-incompleteand the guard is unrecoverable. Names the three —file-source-unidentified,workspace-file-provenance-unknown,mcp-tool-execution-timeout. A latch fromrecord()stays silent, since it reflects a bundle whose own registry already reported and subflow aggregation runs it per iteration.reportIncompleteness. It was copied across both registry latches and would have been copied a third time for the accumulator; a copy that can be updated alone lets the same reason be a fault in one place and routine in another.copilotToolClient.workflowExecution) instead of latching with none, matching the sibling sealed-context path.UnrecordedDurableProvenanceCause, which was a free-formstringcarrying a TSDoc claim that it was always a static literal.Also fixes a latent miss from #6513: the sweep passed a reason to the accumulator's zero-arg
markIncomplete, but nothing caught it — test files are excluded fromtsc, and the extra argument was ignored at runtime. That call is now real.unspecifiedstays, with corrected docs. It has no production callsite by design, but tests use it as an honest "latched, no guard to name" lever; making them borrow a real reason would read as a claim about which guard tripped.Type of Change
Testing
Verified every reason in the union now has at least one producer.
bun run type-checkclean,bun run lintclean,bun run check:audits— all 24 audits pass (includingcheck:api-validation:strict). 3,140 tests green across the registry, durable-provenance, knowledge, providers, copilot-tools, logs, MCP, and file-manage suites. Two new tests pin the accumulator's naming and its silence on a recorded latch.Checklist