improvement(provenance): cleanup secrets boundary

[icecrasher321]

Summary

• Never scan configured-but-unused secrets.
• Never scan Mothership-authored document source or ordinary legacy/user uploads.
• Never mutate tables, files, workflow outputs, or execution behavior based on a match.
• Only project a model-facing copy using secrets proven active in that exact execution/tool call.
• Keep raw persisted and user-visible data unchanged.

Type of Change

• Other: Code Cleanup

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[greptile-apps]

Too many files changed for review (265 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 7, 2026 5:06pm

[cursor]

PR Summary

High Risk
Changes authentication-adjacent secret provenance, model egress projection, and durable storage classification across function execution, providers, Agent, and file/knowledge APIs; incorrect path binding or relaxed legacy paths could leak secrets or over-redact.

Overview
This PR tightens the secrets boundary so provenance and scanning apply only to secrets that were actually compiled or resolved on that call, not every configured environment value. Legacy direct environmentVariables reads and unused env entries no longer infer lineage; placeholder compilation drives output matchers and __resolvedSecretNames.

Durable writes (knowledge, memory, file manage, decompress) now accept incomplete or unavailable authenticated provenance and persist unknown instead of failing the request. Ordinary file mounts without a provenance envelope are treated as user data, not implicit secret scope; binary exports from mounts without secret evidence can be exact-empty.

Model egress shifts to input-path–aware registry APIs (importProvenanceForValueAtInputPath, forkForInputPaths, exportCommittedProvenanceForInputPaths). The Agent handler projects only resolver-recorded paths to provider-facing copies while keeping raw block inputs unchanged; structural fields (tool ids, enums, inline bytes) fail closed. Providers can project legacy unmarked prompts when a private envelope is present; headerless internal calls are preserved where tests expect legacy behavior.

Mothership stops importing MCP discovery provenance into the lifecycle registry and no longer omits MCP tools on schema text matches. Workflow MCP and successful executions without private envelopes are allowed (legacy), with projection only when provenance is present. Workflow sync responses attach provenance from the terminal response body via the logging session, not the full run state.

Fork mapped KB document copy reuses the shared document copier and keeps tracked provenance (exact, exact-empty, unknown) on copy.

^{Reviewed by Cursor Bugbot for commit 043a152. Configure here.}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 043a152. Configure here.}