Files
sim/apps
Vikhyath Mondreti cc611180be improvement(provenance): attribute stored-envelope display reads to their execution (#7039)
* improvement(provenance): attribute stored-envelope display reads to their execution

A display materialization of an execution log imports the row's stored
provenance envelopes into throwaway registries, and each import of an
incomplete envelope re-emitted the registry's own summary — per envelope,
per view, carrying counts and a workspace but never the execution id. A
reader repeatedly materializing the same stored rows produced hundreds of
identical lines that could not say which executions to go look at, and
the volume scaled with views of a state that was fully recorded when the
run wrote it.

Verified against production before changing anything: essentially no new
incomplete envelopes are being stored since the writer fix shipped, and
no data drains exist — the stream is bounded re-reads of old rows through
the display paths, not a live producer.

The display registries are now staged — the existing concept for a
registry that filters one value for a caller that reports against the
real boundary — and each display function reports once per
materialization with the execution id, workflow, workspace, and the
parts that could not be vouched for. Severity is preserved: an
incomplete stored envelope stays at warn, a malformed one stays at
error. Projection behavior is unchanged everywhere — incomplete and
malformed envelopes still fail their values closed exactly as before;
only the reporting moves to the boundary that knows the execution.

* improvement(provenance): fold the incomplete-envelope predicate and pin dual-site reporting

Review pass over the previous commit: one helper instead of three copies
of the incomplete-envelope check, the staged TSDoc generalized to cover
both of its uses, and the block-outputs entry point's two-site reporting
of one run envelope documented and pinned rather than left implicit.

* improvement(provenance): classify every unusable stored envelope at the display boundary

Review findings from the first round, both accepted: a present-but-
malformed block or run envelope was withheld with no attributed line,
and a complete envelope whose entries fail decryption latched the
staged registry with only the unattributed entry-level error.

Fault classification moves into the one import helper the display
paths share, which now returns the registry and the fault together:
absent is not a fault, unparseable is malformed, unable-to-vouch is
incomplete, and a complete envelope whose registry latched during
import — entry decryption is the only latch on that trusted path —
is undecryptable. Every consumer reports through the same table,
severity per kind, so the exact-value loop stops being the only site
that could name a malformed envelope. Withholding behavior is
unchanged at every site.
2026-08-24 11:58:11 -07:00
..
…