fix(files): narrow an initialization to a status the column accepts

The union carries three states; the sidecar's CHECK constraint accepts two. Only the replace
path discriminated — initialize forwarded the status verbatim, so an 'unrecorded' would have
reached the database as a value it rejects, aborting the enclosing transaction rather than
writing a bad row. Nothing passes one today, which is why it belongs here and not in a caller.

Also names the storage mismatch on the type itself: a stored 'unknown' reads back as
'unrecorded', not as the union's 'unknown'. Same word, two layers, different meanings.

Author: icecrasher321

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts

@@ -152,6 +152,24 @@ describe('workspace file secret provenance', () => {
     expect(dbChainMockFns.set).toHaveBeenCalledWith({ secretProvenanceVersion: 1 })
   })
 
+  /**
+   * The union carries three states; the column's CHECK constraint accepts two. Forwarding the
+   * status verbatim would send `'unrecorded'` to the database as a value it rejects, aborting the
+   * enclosing transaction rather than writing a bad row.
+   */
+  it('narrows an unrecorded initialization to a status the column accepts', async () => {
+    await initializeWorkspaceFileSecretProvenanceInTx(
+      dbChainMock.db as unknown as DbTransaction,
+      'file-1',
+      CONTENT_UPDATED_AT,
+      { status: 'unrecorded' }
+    )
+
+    expect(dbChainMockFns.values).toHaveBeenCalledWith(
+      expect.objectContaining({ fileId: 'file-1', status: 'unknown', entries: [] })
+    )
+  })
+
   it('rejects a marker write that cannot bind the exact tracked content version', async () => {
     dbChainMockFns.returning.mockResolvedValueOnce([])
 

apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts

@@ -33,6 +33,17 @@ const LEGACY_ANONYMOUS_WORKSPACE_FILE_SECRET_STORAGE_NAME =
 export const MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE =
   'File cannot be sent to a model because its secret provenance is unavailable'
 
+/**
+ * What can be said about the secrets a file's bytes carry.
+ *
+ * Note the deliberate mismatch with storage: the sidecar's `status` column holds only
+ * `'exact' | 'unknown'`, and a stored `'unknown'` maps to `'unrecorded'` here, not to the
+ * `'unknown'` below. Storage is recording what the writer could vouch for; this union is recording
+ * what a reader can conclude, and "the writer said it could not vouch" and "there is nothing usable
+ * to read" are different conclusions that must not share a branch — only the first is an absence a
+ * policy may relax. `'unrecorded'` is the name the shared vocabulary already uses for it
+ * (`reportUnrecordedDurableProvenance`, the `secret_provenance.unrecorded` audit action).
+ */
 export type WorkspaceFileSecretProvenance =
   | { status: 'exact'; entries: readonly WorkspaceFileSecretProvenanceEntry[] }
   /** Nothing can be said: the row is gone, the version moved, or the sidecar is stale or malformed. */
@@ -421,21 +432,29 @@ export async function replaceWorkspaceFileSecretProvenanceInTx(
   await markWorkspaceFileSecretProvenanceTrackedInTx(tx, fileId, contentUpdatedAt)
 }
 
-/** Initializes provenance for an exact file version without replacing an existing classification. */
+/**
+ * Initializes provenance for an exact file version without replacing an existing classification.
+ *
+ * Narrows to the two states the column accepts, as {@link replaceWorkspaceFileSecretProvenanceInTx}
+ * does. The union has three; the CHECK constraint permits `('exact', 'unknown')`, so forwarding the
+ * status verbatim would let an `'unrecorded'` reach the database as a value it rejects — a
+ * constraint violation aborting the enclosing transaction, not a bad row. Nothing passes one today,
+ * which is exactly why it needs saying here rather than in a caller.
+ */
 export async function initializeWorkspaceFileSecretProvenanceInTx(
   tx: DbTransaction,
   fileId: string,
   contentUpdatedAt: Date,
   provenance: WorkspaceFileSecretProvenance
 ): Promise<void> {
-  const entries =
-    provenance.status === 'exact' ? serializeExactEntriesForStorage(provenance.entries) : []
+  const isExact = provenance.status === 'exact'
+  const entries = isExact ? serializeExactEntriesForStorage(provenance.entries) : []
   await tx
     .insert(workspaceFileSecretProvenance)
     .values({
       fileId,
       contentUpdatedAt,
-      status: provenance.status,
+      status: isExact ? 'exact' : 'unknown',
       entries,
       updatedAt: new Date(),
     })