improvement(provenance): cleanup secrets boundary

[icecrasher321]

Summary

• Never scan configured-but-unused secrets.
• Never scan Mothership-authored document source or ordinary legacy/user uploads.
• Never mutate tables, files, workflow outputs, or execution behavior based on a match.
• Only project a model-facing copy using secrets proven active in that exact execution/tool call.
• Keep raw persisted and user-visible data unchanged.

Type of Change

• Other: Code Cleanup

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[greptile-apps]

Too many files changed for review (265 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 7, 2026 11:53pm

[cursor]

PR Summary

High Risk
Changes secret tracing, model-input projection, and persistence lineage across function execution, providers, MCP, and fork storage—security-sensitive boundaries with broad test updates but subtle behavior shifts for legacy callers.

Overview
Secret provenance is narrowed to what actually ran, instead of inferring from every configured env value or legacy environmentVariables / shell reads. Function execution builds matchers only for secrets compiled via compileCodePlaceholders; when bounded output classification fails, it conservatively reports compiled names only. Ordinary mounted files without a provenance envelope are treated as user data (exact-empty exports), while authenticated incomplete mount bundles still run with unknown exported bytes.

Downstream APIs stop failing closed on weak lineage in several places: knowledge/memory/file writes and incomplete workflow input bundles persist unknown (or exact-empty where appropriate) instead of 400s; MCP workflow tool results and headerless internal guardrails/provider calls can proceed without private envelopes. Workflow execute attaches __resolvedSecretTraceProvenance from the final response body (including errors), not the full run state. Mothership no longer imports MCP discovery provenance or auto-activates secrets from tool descriptions—marker-gated metadata tends toward exact-empty unless paths commit secrets. Providers optionally project legacy prompts when provenance is verified but the request is not already marked projected.

Workspace fork copy/cleanup adds content-addressed KB blobs, document identity mappings, provenance rebinding on copied documents (tag values only; tag names stay raw), and safer failure handling: KBs with live non-fork documents are retained, failed deployment-version sweeps aggregate errors, and decompress/extract can write outputs with unknown provenance instead of rejecting secret-bearing archives outright.

^{Reviewed by Cursor Bugbot for commit d5a91ff. Configure here.}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 043a152. Configure here.}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8cb535d. Configure here.}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d5a91ff. Configure here.}