fix(provenance): name the importer that condemned a run

A bundle that arrives already incomplete latches the whole registry one-way, so
every later model projection in the run refuses. #6483 made the refusal say what
went wrong; it could not say who. In production the answer was
reason=source-provenance-incomplete with 23 candidate importers and no way to
tell them apart, which is where the last investigation stopped.

Carry a stable origin across the import boundary and retain it beside the reason.
It inherits through forks and merges — the step that erased attribution before,
since a tool crossing forks, imports, then merges back — so the refusal names the
importer even though the latch happened frames earlier. Tool crossings take the
tool id, so a tool-sourced bundle identifies itself rather than being inferred
from timestamps.

Origins are caller-supplied strings rather than a closed union, so unlike reasons
they carry an explicit bound.

No behaviour change: the field is optional, additive, and read only when building
a log record.

Author: waleedlatif1

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -288,6 +288,7 @@ async function projectWorkflowMcpModelContent(
 ): Promise<unknown> {
   const registry = new ResolvedSecretTraceRegistry([], scope)
   const imported = await registry.importCrossingProvenance(privateProvenance, value, {
+    origin: 'mcpServe.workflowCrossing',
     trusted: true,
   })
   if (!imported || !registry.isComplete()) {

apps/sim/app/api/providers/route.test.ts

@@ -208,7 +208,10 @@ describe('POST /api/providers', () => {
     )
 
     expect(res.status).toBe(200)
-    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, { trusted: true })
+    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, {
+      trusted: true,
+      origin: 'providersRoute.requestProvenance',
+    })
   })
 
   it('projects legacy private prompt provenance on the provider-facing copy', async () => {

apps/sim/app/api/providers/route.ts

@@ -272,7 +272,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       const provenanceReady =
         await providerRuntimeContext.resolvedSecretTraceRegistry.importProvenance(
           provenanceInspection.value,
-          { trusted: true }
+          { trusted: true, origin: 'providersRoute.requestProvenance' }
         )
       if (!provenanceReady || !providerRuntimeContext.resolvedSecretTraceRegistry.isComplete()) {
         return NextResponse.json(

apps/sim/app/api/workflows/[id]/log/route.ts

@@ -144,7 +144,10 @@ export const POST = withRouteHandler(
         if (trustedProvenance === undefined) {
           resolvedSecretTraceRegistry.markIncomplete()
         } else {
-          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, { trusted: true })
+          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, {
+            trusted: true,
+            origin: 'workflowLogRoute.trustedProvenance',
+          })
         }
         loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
 

apps/sim/executor/handlers/mothership/mothership-handler.test.ts

@@ -293,7 +293,7 @@ describe('MothershipBlockHandler', () => {
         content: 'raw secret remains functional',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(result).toMatchObject({ content: 'raw secret remains functional' })
@@ -519,7 +519,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
     expect(context.errorResolvedSecretTraceRegistry).not.toBe(context.resolvedSecretTraceRegistry)
@@ -557,7 +557,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
@@ -601,7 +601,7 @@ describe('MothershipBlockHandler', () => {
         content: 'unchanged',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(JSON.stringify(result.execution.output)).not.toContain('__resolvedSecretTraceProvenance')

apps/sim/executor/handlers/mothership/mothership-handler.ts

@@ -378,7 +378,10 @@ async function consumeMothershipProvenance(
 
   if (!registry) return false
 
-  const imported = await registry.importProvenanceForValue(provenance, payload, { trusted: true })
+  const imported = await registry.importProvenanceForValue(provenance, payload, {
+    trusted: true,
+    origin: 'mothership.payloadCrossing',
+  })
   if (!imported) throw new Error('Mothership response provenance metadata is invalid')
   return true
 }

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -450,6 +450,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await childResolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.childCrossing',
           })
         }
         // Custom-block children authenticate internal tool calls as the source
@@ -711,6 +712,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await ctx.resolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.parentCrossing',
           })
         }
         return exposedOutput

apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts

@@ -195,6 +195,35 @@ describe('refuseResolvedSecretProjection', () => {
     expect(refusalRecords()).toHaveLength(3)
   })
 
+  it('names the importer that condemned the run, through the fork and merge that hid it', async () => {
+    const parent = new ResolvedSecretTraceRegistry([], scope)
+    const fork = parent.forkForToolCall()
+    await fork.importCrossingProvenance(
+      { version: 1, complete: false, entries: [], scope },
+      { rows: [] },
+      { trusted: true, origin: 'tool.table_query_rows' }
+    )
+    parent.mergeToolCallRegistry(fork)
+    mockLogger.error.mockClear()
+    mockLogger.warn.mockClear()
+
+    expect(() =>
+      refuseResolvedSecretProjection({
+        site: 'router.contextModelInput',
+        message: 'Router model input could not be safely projected',
+        registry: parent,
+        inputPath: 'context,routes',
+      })
+    ).toThrow()
+
+    expect(refusalRecords()[0][1]).toEqual(
+      expect.objectContaining({
+        reason: 'source-provenance-incomplete',
+        origins: ['tool.table_query_rows'],
+      })
+    )
+  })
+
   it('records no secret material', () => {
     const registry = new ResolvedSecretTraceRegistry(
       [{ name: 'API_KEY', plaintext: 'super-secret-value', encryptedValue: 'encrypted' }],

apps/sim/executor/utils/resolved-secret-projection-refusal.ts

@@ -64,6 +64,8 @@ function reportRefusal({ site, registry, inputPath }: ResolvedSecretProjectionRe
       ? {
           reason: diagnostics.reasons[0],
           reasons: diagnostics.reasons,
+          /** The importers that cost the run its completeness — who to go and look at. */
+          ...(diagnostics.origins.length > 0 ? { origins: diagnostics.origins } : {}),
           incompleteInputPathCount: diagnostics.incompleteInputPathCount,
           activeEntryCount: diagnostics.activeEntryCount,
           ...(diagnostics.scopeWorkspaceId

apps/sim/executor/utils/resolved-secret-trace-registry.test.ts

@@ -1562,6 +1562,40 @@ describe('incompleteness diagnostics', () => {
     expect(registry.getIncompletenessDiagnostics()?.reasons[0]).toBe('constructed-incomplete')
   })
 
+  it('attributes an untrustworthy bundle to the caller that imported it', async () => {
+    const registry = new ResolvedSecretTraceRegistry([], scope)
+
+    await registry.importProvenance(
+      { version: 1, complete: false, entries: [], scope },
+      { trusted: true, origin: 'workflowHandler.childCrossing' }
+    )
+
+    expect(registry.getIncompletenessDiagnostics()?.origins).toEqual([
+      'workflowHandler.childCrossing',
+    ])
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Resolved secret registry marked incomplete',
+      expect.objectContaining({
+        reason: 'source-provenance-incomplete',
+        origin: 'workflowHandler.childCrossing',
+      })
+    )
+  })
+
+  it('bounds retained origins, which are caller-supplied rather than a closed union', async () => {
+    const registry = new ResolvedSecretTraceRegistry([], scope)
+
+    for (let index = 0; index < 20; index++) {
+      await registry.importProvenance(
+        { version: 1, complete: false, entries: [], scope },
+        { trusted: true, origin: `caller.${index}` }
+      )
+    }
+
+    expect(registry.getIncompletenessDiagnostics()?.origins).toHaveLength(8)
+    expect(registry.getIncompletenessDiagnostics()?.origins[0]).toBe('caller.0')
+  })
+
   it('records no secret material alongside the reason', () => {
     const registry = new ResolvedSecretTraceRegistry([], scope)