fix(logs): keep run provenance when compaction drops the execution state

[waleedlatif1]

Summary

• Store the run's resolved-secret provenance top-level on execution_data so it survives oversized-payload compaction dropping executionState. Without it the display projection can't rebuild its redaction registry and blanks every span's input/output — a truncated run renders as an empty trace.
• Omit that provenance from both display projections. It holds encrypted secret values and their names, and lifting it top-level would otherwise have exposed it via the logs UI, the v1 API, exports, and external data drains.
• For rows already truncated before this ships, return the stored spans instead of blanking them — they were projected at write time. Scoped to truncated rows with no provenance; malformed, incomplete, or explicit-null keys still fail closed.

Type of Change

• Bug fix

Testing

Traced against a real affected execution: the spans and their input/output are present in execution_data but stripped on read. Added mutation-verified unit tests for the write path, all three compaction tiers, the display omit, and each fail-closed case. 466 tests pass in lib/logs.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 3:43am

[cursor]

PR Summary

Medium Risk
Changes secret projection and log read paths where incorrect provenance handling could leak secrets or blank traces; behavior is heavily tested and display paths explicitly omit server-only provenance.

Overview
Fixes truncated execution logs showing empty traces when oversized execution_data compaction drops executionState and the display projection could no longer rebuild its secret redaction registry.

Write path: On completion, the run’s resolvedSecretTraceProvenance is copied to top-levelexecution_data (from pre-redaction state) so it survives PII redaction and compaction. Minimal compaction keeps that key; the metadata-only tier still drops it when no spans are stored.

Read path:projectExecutionDataForDisplay resolves provenance from the top-level key or executionState, rebuilds the registry for span projection, and never returns provenance to clients (DISPLAY_OMITTED_SERVER_KEYS). For rows truncated before this change (no top-level provenance), stored trace spans are returned as-is when they were already projected at write time; malformed/null provenance still fails closed on span IO and envelope fields.

^{Reviewed by Cursor Bugbot for commit df73bf0. Configure here.}

[greptile-apps]

Greptile Summary

The PR preserves resolved-secret provenance when execution-state compaction occurs while preventing that server-only data from reaching display projections.

• Stores run provenance at the top level of execution data and retains it through applicable compaction tiers.
• Omits provenance from legacy and contract-aware display projections.
• Restores already projected spans for eligible legacy truncated rows while retaining fail-closed handling for malformed provenance.
• Replaces the previously reported explicit any usages in the new tests with typed views and narrowing.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/logs/execution/logger.ts	Lifts run provenance before redaction and preserves it through compaction tiers that retain trace content.
apps/sim/lib/logs/execution/trace-store.ts	Uses top-level provenance for display redaction, omits server-only fields, and handles eligible historical truncated rows.
apps/sim/lib/logs/types.ts	Adds the optional top-level resolved-secret provenance field to the execution-data contract.
apps/sim/lib/logs/execution/logger.test.ts	Covers provenance persistence and compaction while replacing the previously flagged introduced any usages.
apps/sim/lib/logs/execution/trace-store.test.ts	Covers provenance omission, registry reconstruction, legacy truncation fallback, and fail-closed cases with a typed span helper.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Completed execution] --> B[PII projection]
B --> C[Top-level run provenance]
C --> D{Payload oversized?}
D -->|No| E[Persist full execution data]
D -->|Yes| F[Compact execution data]
F --> G[Persist spans and provenance]
E --> H[Display projection]
G --> H
H --> I[Rebuild redaction registry]
I --> J[Return projected trace]
H --> K[Omit server-only provenance]

Loading

_{Reviews (2): Last reviewed commit: "improvement(logs): type the new test hel..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit df73bf0. Configure here.}