Repository navigation
fix(logs): keep provenance sidecars intact through log PII redaction - #9344
Conversation
Log-stage PII masking walks every string leaf of the execution state, so a match inside an encrypted provenance entry rewrote the ciphertext and the display read failed closed with the final output withheld. Restore the finalOutput/workflowInput sidecars, loop/parallel scope provenance, and sourceExecutionId from the pre-redaction state alongside the fields already restored. An undecryptable stored envelope now logs one attributed error per read instead of three.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 4 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.
Turn on auto-fix | Re-trigger cubic
 [Medium impact] The PR appears safe to merge; no actionable issues remain from this review. SummaryPreserves encrypted provenance and
Reviews (2) · Last reviewed commit: "test(provenance): expect provenance impo..." · Reviewed by Greptile |
…lper's own failure log
|
@cubic-dev-ai review this PR |
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
No issues found across 7 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.
Turn on auto-fix | Re-trigger cubic
Summary
executionState. A match inside an encrypted provenance entry (e.g. a digit run in the ciphertext hex) rewrote it, so the AES-GCM auth check failed on read and the log display withheld the final outputpreservePrivateExecutionStateMetadataalready restored run, block-state, block-log and workflow-variable provenance from the pre-redaction state. It now also restoresfinalOutputResolvedSecretTraceProvenance,workflowInputResolvedSecretTraceProvenance, loop/parallel scope provenance (inputResolvedSecretTraceProvenance/resolvedSecretTraceProvenance) andsourceExecutionId, which backfill and run-from-block read backlogFailure: false. The trace-store takes the registry's decrypt summary through a newonDecryptFailureimport option, so it logs one attributedundecryptableerror with the counts and first error. Other importers keep the registry summaryType of Change
Testing
logger.test.ts. It runs the real log PII pass with only the HTTP mask client mocked, then checks that the finalOutput/workflowInput sidecars, loop and parallel scope provenance, andsourceExecutionIdsurvive while user content is still masked. It fails on the pre-fixlogger.ts, and also when only the loop restore, the parallel restore, the scope-level field orsourceExecutionIdis revertedvitest runon logger, trace-store, trace-store-storage, trace-secret-projection, functional-outputs, pii-redaction, logging-session and resolved-secret-trace-registry tests: 228 passedbun run lint,check:comment-hygiene,check:explicit-any,check:utilscheck:auditsand the full suite run in CIChecklist
test-auditauthoring gate)