fix(provenance): relax a latch to unrecorded only when no fault is on record

Review finding, accepted with a broader gate than proposed: zero active
entries alone does not prove the context never held plaintext — a
verification or decrypt fault trips while secret material is in flight,
before anything activates — so keying the absence carve-out on the
entry count alone let a fault-latched registry stamp unrecorded.

Gate it on the one centrally maintained classification of exactly this
distinction: the originating-fault reason set that already decides the
report level. A latch relaxes to unrecorded only when nothing activated
and every recorded reason says provenance was never on offer; any fault
keeps the taint. An allow-list of the single observed reason would have
re-tainted the other genuine absences — a registry born without a
catalog, a durable row nobody recorded, a client tool that never
reported.

Author: icecrasher321

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -99,6 +99,22 @@ export type ResolvedSecretIncompletenessReason =
  * inheriting a parent that reported moments earlier, or an unaudited caller taking the default
  * reason from flooding the error stream. A reason added later without thought stays quiet.
  */
+/**
+ * True when a reason means a guard tripped on a path that should have succeeded, as opposed to
+ * provenance never being on offer. The same set decides the report level above; exposing the
+ * predicate keeps callers that must separate fault from absence — a file write deciding between
+ * taint and `unrecorded` — on the one centrally maintained classification instead of a copy.
+ *
+ * A fault matters to such callers because it can coexist with plaintext that never activated: a
+ * verification or decrypt failure happens *while* secret material is in flight, so an empty active
+ * set does not prove the context never held any.
+ */
+export function isResolvedSecretIncompletenessFault(
+  reason: ResolvedSecretIncompletenessReason
+): boolean {
+  return ORIGINATING_FAULT_REASONS.has(reason)
+}
+
 const ORIGINATING_FAULT_REASONS = new Set<ResolvedSecretIncompletenessReason>([
   'untrusted-provenance',
   'entry-decrypt-failed',

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts

@@ -1578,6 +1578,31 @@ describe('createWorkspaceFileSecretProvenanceFromRegistry write decision', () =>
     ).resolves.toEqual({ safe: true, provenance: { status: 'unrecorded' } })
   })
 
+  /**
+   * Zero active entries does not prove the context never held plaintext: a verification or
+   * decrypt fault trips while secret material is in flight, before anything activates. Only a
+   * latch whose recorded reasons are all non-fault absences may relax to unrecorded.
+   */
+  it('keeps a latch caused by an originating fault as a taint even with no active entries', async () => {
+    const registry = {
+      exportCommittedProvenanceForValue: vi.fn(() => ({
+        version: 1,
+        complete: false,
+        entries: [],
+      })),
+      getIncompletenessDiagnostics: vi.fn(() => ({
+        reasons: ['projection-mismatch'],
+        origins: [],
+        incompleteInputPathCount: 0,
+        activeEntryCount: 0,
+      })),
+    } as unknown as ResolvedSecretTraceRegistry
+
+    await expect(
+      createWorkspaceFileSecretProvenanceFromRegistry(registry, 'generated content', SCOPE)
+    ).resolves.toEqual({ safe: false })
+  })
+
   it('keeps a latched registry holding plaintext it cannot map as a taint', async () => {
     const registry = {
       exportCommittedProvenanceForValue: vi.fn(() => ({

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts

@@ -20,9 +20,10 @@ import {
   PROVENANCE_MAX_ENTRIES,
   PROVENANCE_MAX_SERIALIZED_BYTES,
 } from '@/lib/execution/provenance-limits'
-import type {
-  ResolvedSecretTraceProvenanceV1,
-  ResolvedSecretTraceRegistry,
+import {
+  isResolvedSecretIncompletenessFault,
+  type ResolvedSecretTraceProvenanceV1,
+  type ResolvedSecretTraceRegistry,
 } from '@/executor/utils/resolved-secret-trace-registry'
 
 /** Ids per statement. Bounds the query, never how many files a caller may classify. */
@@ -255,14 +256,20 @@ export async function createWorkspaceFileSecretProvenanceFromRegistry(
     : registry.exportCommittedProvenanceForValue(persistedValue)
   if (!sourceProvenance.complete || !persistedProvenance.complete) {
     /**
-     * A latched registry holding no active entries is the same absence: no secret plaintext was
-     * ever resolved or imported in this context, so none can be in these bytes — the latch says
-     * only that content of unrecorded history crossed (a failed workflow run is the recurring
-     * producer), which is exactly what `unrecorded` states. Taint stays reserved for a registry
-     * that holds plaintext it cannot map to this output: stamping it here made one failed run
-     * turn every file its chat later wrote into a hard refusal until the next clean write.
+     * A latched registry is the same absence only when both hold: nothing activated, and no
+     * recorded reason is an originating fault. Zero active entries alone does not prove the
+     * context never held plaintext — a verification or decrypt fault trips while secret material
+     * is in flight — so any fault reason keeps the taint. What remains is a registry that latched
+     * because provenance was never on offer (a failed workflow run crossing with no envelope is
+     * the recurring producer), which is exactly what `unrecorded` states. Stamping taint for that
+     * state made one failed run turn every file its chat later wrote into a hard refusal until
+     * the next clean write.
      */
-    if (registry.getIncompletenessDiagnostics()?.activeEntryCount === 0) {
+    const diagnostics = registry.getIncompletenessDiagnostics()
+    if (
+      diagnostics?.activeEntryCount === 0 &&
+      !diagnostics.reasons.some(isResolvedSecretIncompletenessFault)
+    ) {
       return { safe: true, provenance: { status: 'unrecorded' } }
     }
     return { safe: false }