fix(provenance): record why a resolved-secret registry became incomplete

Incompleteness is one-way and fails every later model projection in the run, so a
single trip surfaces to the user as 'Router model input could not be safely
projected' and nothing else. Nine guards could set it and none said which, in a
file that imported no logger at all — a production failure this week could not be
attributed to any of them.

Name each guard, and stop the decrypt catch from discarding its cause. Reasons are
static literals and the logged input path is block/field names; no resolved value
is recorded.

Author: waleedlatif1

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -1,3 +1,5 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { decryptSecret } from '@/lib/core/security/encryption'
 import { isLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest-metadata'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
@@ -10,6 +12,30 @@ import {
 } from '@/executor/utils/resolved-secret-matcher'
 import { getResolvedSecretMatcherCapacityFailure } from '@/executor/utils/resolved-secret-matcher-capacity'
 
+const logger = createLogger('ResolvedSecretTraceRegistry')
+
+/**
+ * Why a registry stopped being able to vouch for what it projects.
+ *
+ * Incompleteness is one-way and fails every later model projection in the run, surfacing to the
+ * user as a single opaque sentence. Recording which guard tripped is the only way to tell a
+ * genuine containment from a matcher that merely could not decide — the reasons are static
+ * literals and the logged path is block/field names, never a resolved value.
+ */
+type ResolvedSecretIncompletenessReason =
+  | 'untrusted-provenance'
+  | 'source-provenance-incomplete'
+  | 'entry-decrypt-failed'
+  | 'unverified-resolved-entry'
+  | 'projection-mismatch'
+  | 'unresolved-placeholder'
+  | 'filter-capacity-exceeded'
+  | 'restored-checkpoint-unavailable'
+  | 'value-provenance-untrusted'
+  | 'value-provenance-import-failed'
+  | 'value-provenance-filter-incomplete'
+  | 'unspecified'
+
 export const ANONYMOUS_SECRET_TRACE_REPLACEMENT = OPAQUE_RESOLVED_SECRET_REPLACEMENT
 export const RESOLVED_SECRET_TRACE_CHECKPOINT_VERSION = 1
 
@@ -669,7 +695,7 @@ export class ResolvedSecretTraceRegistry {
 
     const entry = this.getVerifiedResolvedEntry(name, resolvedValue)
     if (!entry) {
-      this.markInputPathIncomplete(path)
+      this.markInputPathIncomplete(path, 'unverified-resolved-entry')
       return false
     }
 
@@ -790,7 +816,7 @@ export class ResolvedSecretTraceRegistry {
         typeof projectedValue === 'string' &&
         state.projectedValue !== projectedValue
       ) {
-        this.markInputPathIncomplete(path)
+        this.markInputPathIncomplete(path, 'projection-mismatch')
         return
       }
       for (const entryKey of entryKeys) state.entryKeys.add(entryKey)
@@ -846,7 +872,7 @@ export class ResolvedSecretTraceRegistry {
         if (current.raw !== null && typeof current.raw === 'object') {
           const standaloneName = canonicalPlaceholderName(current.projected as string)
           if (!standaloneName || !entryKeysByName.has(standaloneName)) {
-            this.markInputPathIncomplete(current.path)
+            this.markInputPathIncomplete(current.path, 'unresolved-placeholder')
             return
           }
           recordProjectedMarkerAcrossRawLeaves(
@@ -994,12 +1020,12 @@ export class ResolvedSecretTraceRegistry {
     options: ImportResolvedSecretTraceProvenanceOptions
   ): Promise<boolean> {
     if (!options.trusted || !isResolvedSecretTraceProvenanceV1(provenance)) {
-      this.markIncomplete()
+      this.markIncomplete('untrusted-provenance')
       return false
     }
 
     if (!provenance.complete) {
-      this.markIncomplete()
+      this.markIncomplete('source-provenance-incomplete')
     }
 
     const sameScope = scopesMatch(provenance.scope, this.scope)
@@ -1016,9 +1042,14 @@ export class ResolvedSecretTraceRegistry {
           },
           { propagated: true }
         )
-      } catch {
+      } catch (error) {
         importedAll = false
-        this.markIncomplete()
+        logger.warn('Provenance entry could not be decrypted', {
+          error: getErrorMessage(error, 'Unknown error'),
+          named: entry.name !== undefined,
+          scopeWorkspaceId: this.scope?.workspaceId,
+        })
+        this.markIncomplete('entry-decrypt-failed')
       }
     }
 
@@ -1058,19 +1089,19 @@ export class ResolvedSecretTraceRegistry {
     options: { trusted: boolean; inputPath?: ResolvedSecretInputPath }
   ): Promise<ImportResolvedSecretTraceProvenanceForValueResult> {
     if (!options.trusted || !isResolvedSecretTraceProvenanceV1(provenance)) {
-      this.markInputPathIncomplete(options.inputPath)
+      this.markInputPathIncomplete(options.inputPath, 'value-provenance-untrusted')
       return { success: false, matched: false }
     }
 
     const sourceRegistry = new ResolvedSecretTraceRegistry([], provenance.scope)
     const sourceImported = await sourceRegistry.importProvenance(provenance, { trusted: true })
     const filteredProvenance = sourceRegistry.exportProvenanceForValue(value)
     if (!sourceImported) {
-      this.markInputPathIncomplete(options.inputPath)
+      this.markInputPathIncomplete(options.inputPath, 'value-provenance-import-failed')
       return { success: false, matched: false }
     }
     if (!filteredProvenance.complete) {
-      this.markInputPathIncomplete(options.inputPath)
+      this.markInputPathIncomplete(options.inputPath, 'value-provenance-filter-incomplete')
       return { success: true, matched: false }
     }
     const filteredImported = await this.importProvenance(filteredProvenance, { trusted: true })
@@ -1214,10 +1245,16 @@ export class ResolvedSecretTraceRegistry {
     return !this.complete || this.incompleteInputPaths.size > 0
   }
 
-  markIncomplete(): void {
+  markIncomplete(reason: ResolvedSecretIncompletenessReason = 'unspecified'): void {
     if (!this.complete) return
     this.complete = false
     this.modelEgressRevision += 1
+    logger.warn('Resolved secret registry marked incomplete', {
+      reason,
+      scopeWorkspaceId: this.scope?.workspaceId,
+      activeEntryCount: this.activeEntries.size,
+      incompleteInputPathCount: this.incompleteInputPaths.size,
+    })
   }
 
   /**
@@ -1388,7 +1425,11 @@ export class ResolvedSecretTraceRegistry {
       matcher = createResolvedSecretMatcher(
         [...candidatesByScanLiteral.keys()].map((plaintext) => ({ plaintext, replacement: '' }))
       )
-    } catch {
+    } catch (error) {
+      logger.warn('Provenance filter matcher could not be built', {
+        error: getErrorMessage(error, 'Unknown error'),
+        candidateCount: candidatesByScanLiteral.size,
+      })
       return { complete: false }
     }
 
@@ -1623,15 +1664,24 @@ export class ResolvedSecretTraceRegistry {
     )
   }
 
-  private markInputPathIncomplete(path: ResolvedSecretInputPath | undefined): void {
+  private markInputPathIncomplete(
+    path: ResolvedSecretInputPath | undefined,
+    reason: ResolvedSecretIncompletenessReason = 'unspecified'
+  ): void {
     if (!path || path.length === 0) {
-      this.markIncomplete()
+      this.markIncomplete(reason)
       return
     }
     const key = inputPathKey(path)
     if (this.incompleteInputPaths.has(key)) return
     this.incompleteInputPaths.set(key, [...path])
     this.modelEgressRevision += 1
+    logger.warn('Resolved secret input path marked incomplete', {
+      reason,
+      inputPath: path.join('.'),
+      scopeWorkspaceId: this.scope?.workspaceId,
+      activeEntryCount: this.activeEntries.size,
+    })
   }
 
   private copyIncompleteInputPathsTo(