fix(provenance): attribute the path-scoped and short-circuit latches too

importProvenanceForValueAtInputPath took only { trusted }, so the five callers
that bind a crossing to an input path — the block, loop, parallel and workflow
resolvers, and the guardrails route — could not name themselves.

Separately, six latches sit beside a tagged import on the path where the import
did not run or returned false: a bundle already marked incomplete short-circuits
the || before the import, and each catch latches directly. Those reported no
origin while their neighbour reported one.

Author: waleedlatif1

apps/sim/app/api/guardrails/validate/route.test.ts

@@ -244,6 +244,7 @@ describe('POST /api/guardrails/validate', () => {
     expect(res.status).toBe(200)
     expect(mockImportProvenance).toHaveBeenCalledWith(provenance, 'secret value', ['input'], {
       trusted: true,
+      origin: 'guardrailsRoute.inputProvenance',
     })
   })
 

apps/sim/app/api/guardrails/validate/route.ts

@@ -267,7 +267,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
                 provenanceInspection.value,
                 inputStr,
                 ['input'],
-                { trusted: true }
+                { trusted: true, origin: 'guardrailsRoute.inputProvenance' }
               )
             ).success
           : true

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -1192,7 +1192,7 @@ export class ResolvedSecretTraceRegistry {
     provenance: unknown,
     value: unknown,
     inputPath: ResolvedSecretInputPath | undefined,
-    options: { trusted: boolean }
+    options: { trusted: boolean; origin?: string }
   ): Promise<ImportResolvedSecretTraceProvenanceForValueResult> {
     return this.importProvenanceForValueInternal(provenance, value, {
       ...options,

apps/sim/executor/variables/resolvers/block.ts

@@ -337,7 +337,7 @@ export class BlockResolver implements Resolver {
         state.resolvedSecretTraceProvenance,
         value,
         context.inputPath,
-        { trusted: true }
+        { trusted: true, origin: 'blockResolver.outputCrossing' }
       )
     if (imported.matched) context.onResolvedSecretReference?.()
     return value

apps/sim/executor/variables/resolvers/loop.ts

@@ -283,7 +283,7 @@ export class LoopResolver implements Resolver {
       provenance,
       resolvedValue,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'loopResolver.itemCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return resolvedValue

apps/sim/executor/variables/resolvers/parallel.ts

@@ -390,7 +390,7 @@ export class ParallelResolver implements Resolver {
       provenance,
       resolvedValue,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'parallelResolver.itemCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return resolvedValue

apps/sim/executor/variables/resolvers/workflow.ts

@@ -133,7 +133,7 @@ export class WorkflowResolver implements Resolver {
       provenance,
       value,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'workflowResolver.inputCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return value

apps/sim/lib/copilot/request/tools/client.ts

@@ -107,14 +107,16 @@ export async function waitForClientToolCompletion({
           trusted: true,
         })
         if (!imported || !sealedContext.provenance.complete) {
-          toolRegistry.markIncomplete()
+          toolRegistry.markIncomplete('source-provenance-incomplete', {
+            origin: 'copilotToolClient.sealedContext',
+          })
         } else {
           content = sealedContent
         }
       }
     }
   } catch {
-    toolRegistry?.markIncomplete()
+    toolRegistry?.markIncomplete('unspecified', { origin: 'copilotToolClient.sealedContext' })
   } finally {
     finishPendingActivation?.()
   }

apps/sim/lib/copilot/tools/handlers/function-execute.ts

@@ -533,10 +533,14 @@ export async function resolveInputFiles(
             origin: 'copilotFunctionExecute.result',
           }))
         ) {
-          resolvedSecretTraceRegistry.markIncomplete()
+          resolvedSecretTraceRegistry.markIncomplete('source-provenance-incomplete', {
+            origin: 'copilotFunctionExecute.result',
+          })
         }
       } catch {
-        resolvedSecretTraceRegistry.markIncomplete()
+        resolvedSecretTraceRegistry.markIncomplete('source-provenance-incomplete', {
+          origin: 'copilotFunctionExecute.result',
+        })
       }
 
       const columns = table.schema.columns
@@ -567,9 +571,10 @@ async function importMountedProvenance(
       origin: 'copilotFunctionExecute.crossing',
       trusted: true,
     })
-    if (!imported) target.markIncomplete()
+    if (!imported)
+      target.markIncomplete('unspecified', { origin: 'copilotFunctionExecute.crossing' })
   } catch {
-    target.markIncomplete()
+    target.markIncomplete('unspecified', { origin: 'copilotFunctionExecute.crossing' })
   }
 }
 

apps/sim/lib/logs/execution/trace-store.ts

@@ -309,7 +309,7 @@ export async function projectExecutionDataForDisplay(
         origin: 'traceStore.exactProvenance',
       })
     } else {
-      exactRegistry.markIncomplete()
+      exactRegistry.markIncomplete('untrusted-provenance', { origin: 'traceStore.exactProvenance' })
     }
 
     const [projected] = await projectTraceSpansForSecrets(