chore(api): merge latest provenance update

# Conflicts:
#	apps/sim/app/api/mcp/serve/[serverId]/route.ts
#	apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts

Author: TheodoreSpeaks

apps/sim/app/api/guardrails/validate/route.test.ts

@@ -244,6 +244,7 @@ describe('POST /api/guardrails/validate', () => {
     expect(res.status).toBe(200)
     expect(mockImportProvenance).toHaveBeenCalledWith(provenance, 'secret value', ['input'], {
       trusted: true,
+      origin: 'guardrailsRoute.inputProvenance',
     })
   })
 

apps/sim/app/api/guardrails/validate/route.ts

@@ -267,7 +267,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
                 provenanceInspection.value,
                 inputStr,
                 ['input'],
-                { trusted: true }
+                { trusted: true, origin: 'guardrailsRoute.inputProvenance' }
               )
             ).success
           : true

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -215,7 +215,10 @@ async function projectWorkflowToolOutput(
   }
 
   const registry = new ResolvedSecretTraceRegistry([], scope)
-  const imported = await registry.importProvenance(provenance, { trusted: true })
+  const imported = await registry.importProvenance(provenance, {
+    trusted: true,
+    origin: 'mcpServe.workflowCrossing',
+  })
   if (!imported || !registry.isComplete()) {
     throw new Error('MCP workflow execution provenance could not be restored')
   }

apps/sim/app/api/providers/route.test.ts

@@ -208,7 +208,10 @@ describe('POST /api/providers', () => {
     )
 
     expect(res.status).toBe(200)
-    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, { trusted: true })
+    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, {
+      trusted: true,
+      origin: 'providersRoute.requestProvenance',
+    })
   })
 
   it('projects legacy private prompt provenance on the provider-facing copy', async () => {

apps/sim/app/api/providers/route.ts

@@ -272,7 +272,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       const provenanceReady =
         await providerRuntimeContext.resolvedSecretTraceRegistry.importProvenance(
           provenanceInspection.value,
-          { trusted: true }
+          { trusted: true, origin: 'providersRoute.requestProvenance' }
         )
       if (!provenanceReady || !providerRuntimeContext.resolvedSecretTraceRegistry.isComplete()) {
         return NextResponse.json(

apps/sim/app/api/workflows/[id]/log/route.ts

@@ -144,7 +144,10 @@ export const POST = withRouteHandler(
         if (trustedProvenance === undefined) {
           resolvedSecretTraceRegistry.markIncomplete()
         } else {
-          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, { trusted: true })
+          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, {
+            trusted: true,
+            origin: 'workflowLogRoute.trustedProvenance',
+          })
         }
         loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
 

apps/sim/executor/handlers/mothership/mothership-handler.test.ts

@@ -293,7 +293,7 @@ describe('MothershipBlockHandler', () => {
         content: 'raw secret remains functional',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(result).toMatchObject({ content: 'raw secret remains functional' })
@@ -519,7 +519,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
     expect(context.errorResolvedSecretTraceRegistry).not.toBe(context.resolvedSecretTraceRegistry)
@@ -557,7 +557,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
@@ -601,7 +601,7 @@ describe('MothershipBlockHandler', () => {
         content: 'unchanged',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(JSON.stringify(result.execution.output)).not.toContain('__resolvedSecretTraceProvenance')

apps/sim/executor/handlers/mothership/mothership-handler.ts

@@ -378,7 +378,10 @@ async function consumeMothershipProvenance(
 
   if (!registry) return false
 
-  const imported = await registry.importProvenanceForValue(provenance, payload, { trusted: true })
+  const imported = await registry.importProvenanceForValue(provenance, payload, {
+    trusted: true,
+    origin: 'mothership.payloadCrossing',
+  })
   if (!imported) throw new Error('Mothership response provenance metadata is invalid')
   return true
 }

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -459,6 +459,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await childResolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.childCrossing',
           })
         }
         // Custom-block children authenticate internal tool calls as the source
@@ -720,6 +721,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await ctx.resolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.parentCrossing',
           })
         }
         return exposedOutput

apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts

@@ -195,6 +195,35 @@ describe('refuseResolvedSecretProjection', () => {
     expect(refusalRecords()).toHaveLength(3)
   })
 
+  it('names the importer that condemned the run, through the fork and merge that hid it', async () => {
+    const parent = new ResolvedSecretTraceRegistry([], scope)
+    const fork = parent.forkForToolCall()
+    await fork.importCrossingProvenance(
+      { version: 1, complete: false, entries: [], scope },
+      { rows: [] },
+      { trusted: true, origin: 'tool.table_query_rows' }
+    )
+    parent.mergeToolCallRegistry(fork)
+    mockLogger.error.mockClear()
+    mockLogger.warn.mockClear()
+
+    expect(() =>
+      refuseResolvedSecretProjection({
+        site: 'router.contextModelInput',
+        message: 'Router model input could not be safely projected',
+        registry: parent,
+        inputPath: 'context,routes',
+      })
+    ).toThrow()
+
+    expect(refusalRecords()[0][1]).toEqual(
+      expect.objectContaining({
+        reason: 'source-provenance-incomplete',
+        origins: ['tool.table_query_rows'],
+      })
+    )
+  })
+
   it('records no secret material', () => {
     const registry = new ResolvedSecretTraceRegistry(
       [{ name: 'API_KEY', plaintext: 'super-secret-value', encryptedValue: 'encrypted' }],