fix(logs): keep provenance sidecars intact through log PII redaction

Merged
WA
6d ago
+202-56

Summary

  • Log-stage PII masking walks every string leaf of executionState. A match inside an encrypted provenance entry (e.g. a digit run in the ciphertext hex) rewrote it, so the AES-GCM auth check failed on read and the log display withheld the final output
  • preservePrivateExecutionStateMetadata already restored run, block-state, block-log and workflow-variable provenance from the pre-redaction state. It now also restores finalOutputResolvedSecretTraceProvenance, workflowInputResolvedSecretTraceProvenance, loop/parallel scope provenance (inputResolvedSecretTraceProvenance / resolvedSecretTraceProvenance) and sourceExecutionId, which backfill and run-from-block read back
  • User-content fields are still masked exactly as before. Only server-written metadata is copied back
  • Log noise: an undecryptable stored envelope logged three errors per read (encryption, registry summary, trace-store). The registry now decrypts with logFailure: false. The trace-store takes the registry's decrypt summary through a new onDecryptFailure import option, so it logs one attributed undecryptable error with the counts and first error. Other importers keep the registry summary
  • Fault semantics and what the reader sees are unchanged. Rows that are already corrupted stay fail-closed

Type of Change

  • Bug fix

Testing

  • New regression test in logger.test.ts. It runs the real log PII pass with only the HTTP mask client mocked, then checks that the finalOutput/workflowInput sidecars, loop and parallel scope provenance, and sourceExecutionId survive while user content is still masked. It fails on the pre-fix logger.ts, and also when only the loop restore, the parallel restore, the scope-level field or sourceExecutionId is reverted
  • vitest run on logger, trace-store, trace-store-storage, trace-secret-projection, functional-outputs, pii-redaction, logging-session and resolved-secret-trace-registry tests: 228 passed
  • bun run lint, check:comment-hygiene, check:explicit-any, check:utils
  • Type-check, check:audits and the full suite run in CI

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)