fix(provenance): classify a latched-but-empty registry's file writes as unrecorded

A copilot chat whose registry latched — the recurring producer is a
workflow run that failed before exporting provenance, crossing as
value-provenance-absent — stamped every file it later wrote with the
unknown taint, which no policy relaxes. The chat then could not read
the file back: generating a document and immediately rendering it to
show the user hard-failed with "cannot be shared safely", and healed
only when a later clean turn rewrote the sidecar. Traced in
production: the refused file's terminal sidecar is exact with zero
entries — a file with no secrets in it — and the last refusal landed
under a minute before the healthy write.

The write decision now distinguishes the two states its own policy
names. A latched registry holding no active entries is an absence: no
secret plaintext was resolved or imported in that context, so none can
be in the bytes, and the only fact is that content of unrecorded
history crossed — which is what the unrecorded status states, readable
under the fail-open policy with the audit entry naming the surface.
Taint stays reserved for a registry that holds plaintext it cannot map
to this output, and for every structural refusal below (scope, derived
representations, encryption).

Also carries the fault kind as a structured field on the trace-store
display lines, so dashboards can group without parsing messages.

Author: icecrasher321

apps/sim/lib/copilot/request/tools/files.test.ts

@@ -563,6 +563,13 @@ describe('maybeWriteOutputToFile', () => {
       .mockReturnValueOnce({ version: 1, complete: false, entries: [] })
     const registry = {
       exportCommittedProvenanceForValue,
+      /** Plaintext is in scope, so the incomplete export below is a taint, not an absence. */
+      getIncompletenessDiagnostics: vi.fn(() => ({
+        reasons: ['source-provenance-incomplete'],
+        origins: [],
+        incompleteInputPathCount: 0,
+        activeEntryCount: 1,
+      })),
     } as unknown as ResolvedSecretTraceRegistry
 
     const result = await maybeWriteOutputToFile(

apps/sim/lib/logs/execution/trace-store.ts

@@ -439,6 +439,7 @@ function reportStoredDisplayProvenanceFaults(
     if (parts.length === 0) continue
     logger[report.level](report.message, {
       ...details,
+      fault: kind,
       parts: parts.slice(0, MAX_REPORTED_PROVENANCE_FAULT_PARTS),
       partCount: parts.length,
     })

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts

@@ -20,6 +20,7 @@ import type { DbTransaction } from '@/lib/db/types'
 import {
   areModelSafeWorkspaceFileKeys,
   copyWorkspaceFileSecretProvenanceInTx,
+  createWorkspaceFileSecretProvenanceFromRegistry,
   filterModelSafeWorkspaceFileAttachments,
   importWorkspaceFileSecretProvenanceForModelView,
   importWorkspaceFileSecretProvenanceForRuntime,
@@ -1548,3 +1549,67 @@ describe('workspace file secret provenance', () => {
     ).toEqual({ status: 'unknown' })
   })
 })
+
+describe('createWorkspaceFileSecretProvenanceFromRegistry write decision', () => {
+  const SCOPE = { userId: 'user-1', workspaceId: 'workspace-1' }
+
+  /**
+   * A registry latched with nothing resolved is an absence, not a taint: no plaintext exists in
+   * the context to be in the bytes, so the file must stay readable under the unrecorded policy.
+   * Stamping taint here made one failed workflow run hard-refuse every file its chat later wrote.
+   */
+  it('classifies a latched registry holding no active entries as unrecorded', async () => {
+    const registry = {
+      exportCommittedProvenanceForValue: vi.fn(() => ({
+        version: 1,
+        complete: false,
+        entries: [],
+      })),
+      getIncompletenessDiagnostics: vi.fn(() => ({
+        reasons: ['value-provenance-absent'],
+        origins: [],
+        incompleteInputPathCount: 0,
+        activeEntryCount: 0,
+      })),
+    } as unknown as ResolvedSecretTraceRegistry
+
+    await expect(
+      createWorkspaceFileSecretProvenanceFromRegistry(registry, 'generated content', SCOPE)
+    ).resolves.toEqual({ safe: true, provenance: { status: 'unrecorded' } })
+  })
+
+  it('keeps a latched registry holding plaintext it cannot map as a taint', async () => {
+    const registry = {
+      exportCommittedProvenanceForValue: vi.fn(() => ({
+        version: 1,
+        complete: false,
+        entries: [],
+      })),
+      getIncompletenessDiagnostics: vi.fn(() => ({
+        reasons: ['source-provenance-incomplete'],
+        origins: [],
+        incompleteInputPathCount: 0,
+        activeEntryCount: 1,
+      })),
+    } as unknown as ResolvedSecretTraceRegistry
+
+    await expect(
+      createWorkspaceFileSecretProvenanceFromRegistry(registry, 'generated content', SCOPE)
+    ).resolves.toEqual({ safe: false })
+  })
+
+  it('stays a taint when the incomplete export carries no diagnostics to vouch with', async () => {
+    const registry = {
+      exportCommittedProvenanceForValue: vi.fn(() => ({
+        version: 1,
+        complete: false,
+        entries: [],
+      })),
+      getIncompletenessDiagnostics: vi.fn(() => undefined),
+    } as unknown as ResolvedSecretTraceRegistry
+
+    await expect(
+      createWorkspaceFileSecretProvenanceFromRegistry(registry, 'generated content', SCOPE)
+    ).resolves.toEqual({ safe: false })
+  })
+})

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts

@@ -253,7 +253,20 @@ export async function createWorkspaceFileSecretProvenanceFromRegistry(
   const persistedProvenance = Object.is(sourceValue, persistedValue)
     ? sourceProvenance
     : registry.exportCommittedProvenanceForValue(persistedValue)
-  if (!sourceProvenance.complete || !persistedProvenance.complete) return { safe: false }
+  if (!sourceProvenance.complete || !persistedProvenance.complete) {
+    /**
+     * A latched registry holding no active entries is the same absence: no secret plaintext was
+     * ever resolved or imported in this context, so none can be in these bytes — the latch says
+     * only that content of unrecorded history crossed (a failed workflow run is the recurring
+     * producer), which is exactly what `unrecorded` states. Taint stays reserved for a registry
+     * that holds plaintext it cannot map to this output: stamping it here made one failed run
+     * turn every file its chat later wrote into a hard refusal until the next clean write.
+     */
+    if (registry.getIncompletenessDiagnostics()?.activeEntryCount === 0) {
+      return { safe: true, provenance: { status: 'unrecorded' } }
+    }
+    return { safe: false }
+  }
   if (
     (sourceProvenance.entries.length > 0 &&
       !isPrivateSecretProvenanceScopeCompatible(sourceProvenance.scope, destinationScope)) ||