fix(provenance): carry the run's result through post-execution failures

Round 2, cubic's finding accepted — and it was a distinct window, not a
restatement of round 1. The executor's post-execution work runs after
the run has produced a result but before `executeWorkflow` returns, so
a failure there reached callers with no result attached: the run threw
nothing itself, and the flag added last round could not be set yet.
Every consumer that reads a missing result as "no block ran" was wrong
in that window, this crossing included.

Fix it where the result lives rather than at each reader. The executor
attaches its own on the throws it raises; `executeWorkflow` now does the
same for failures raised after it holds one, skipping the case the
executor already recorded. Logging and trace spans get the same benefit
for free — they read the identical signal.

That makes an absent result total again, so the boolean flag goes and
the crossing reads one thing: the result from the error, or the one
already returned when the failure came later still, from the crossing
itself. Only a failure with neither can claim nothing ran. The
post-return case now describes content with the run's real envelope
rather than latching blind, which is strictly more accurate than either
prior behaviour.

Author: icecrasher321

apps/sim/lib/workflows/application/run-workflow-from-copilot.test.ts

@@ -471,6 +471,33 @@ describe('Copilot workflow run application commands', () => {
       )
     })
 
+    /**
+     * The executor's post-execution work can throw after a run has already produced a result.
+     * `executeWorkflow` carries it on that throw, so this reaches the catch with a result and
+     * must not be claimed as never-started.
+     */
+    it('does not vouch when post-execution work threw after the engine ran', async () => {
+      const { importCrossingProvenance, lifecycle: tracked } = trackingLifecycle()
+      const incomplete = { version: 1 as const, complete: false, entries: [] }
+      mocks.executeWorkflow.mockRejectedValueOnce(
+        Object.assign(new Error('post-execution persistence failed'), {
+          executionResult: {
+            success: true,
+            output: { ran: true },
+            executionState: { resolvedSecretTraceProvenance: incomplete },
+          },
+        })
+      )
+
+      await runExpectingFailure({ lifecycle: tracked })
+
+      expect(importCrossingProvenance).toHaveBeenCalledWith(
+        incomplete,
+        expect.objectContaining({ output: { ran: true } }),
+        expect.objectContaining({ origin: 'copilotWorkflowMutation.failedRunCrossing' })
+      )
+    })
+
     /** A run that did execute and could not vouch still hands back its incomplete envelope. */
     it('passes through an incomplete envelope from a run that did execute', async () => {
       const { importCrossingProvenance, lifecycle: tracked } = trackingLifecycle()

apps/sim/lib/workflows/application/run-workflow-from-copilot.ts

@@ -254,11 +254,12 @@ async function executeCopilotRun(params: {
   )
   const completePendingActivation = registry?.beginPendingActivation()
   /**
-   * Whether the executor returned. The post-run crossing is inside the same `try`, so its own
-   * failure lands in the catch carrying no execution result — indistinguishable, on that
-   * evidence alone, from a run that never started. This records the difference the error cannot.
+   * The run's own result, once the executor returns it. The post-run crossing below is inside the
+   * same `try`, so its failure reaches the catch carrying nothing — and on that evidence alone it
+   * is indistinguishable from a run that never started. Holding the result here keeps the real
+   * envelope available to describe content that certainly exists.
    */
-  let executed = false
+  let runResult: ExecutionResult | undefined
   /**
    * The executor call is the first statement of this `try`, so everything caught below is
    * post-dispatch by construction, while authorization, admission and provenance export all
@@ -311,7 +312,7 @@ async function executeCopilotRun(params: {
       },
       childExecutionId
     )
-    executed = true
+    runResult = result
     if (registry) {
       await registry.importCrossingProvenance(
         result.executionState?.resolvedSecretTraceProvenance,
@@ -335,24 +336,23 @@ async function executeCopilotRun(params: {
      * as never started and invite the duplicate this id exists to prevent.
      */
     if (registry) {
-      const executionResult = hasExecutionResult(error) ? error.executionResult : undefined
+      /**
+       * Either source counts as proof a run exists: the error carries the result when the run or
+       * its post-execution work threw, and `runResult` holds it when the failure came later still
+       * — from the crossing below, after the executor had already returned.
+       */
+      const executionResult = hasExecutionResult(error) ? error.executionResult : runResult
       try {
         /**
-         * A run that never started carried nothing back, and saying so keeps the caller's
-         * failure reason instead of reducing the tool result to "result unavailable" for a
-         * message that named no secret because none had been resolved yet.
-         *
-         * Both conditions are required to claim it. `executed` rules out the post-run window,
-         * where the crossing import is what threw: an execution exists and its provenance was
-         * never imported, so its content is exactly what cannot be vouched for. The absent
-         * execution result then rules out the engine having run at all — it attaches one to
-         * every throw. Anything else hands back whatever envelope it has, and an incomplete one
-         * still latches.
+         * Only a failure with no result from either source can claim nothing ran, and saying so
+         * keeps the caller's failure reason instead of reducing the tool result to "result
+         * unavailable" for a message that named no secret because none had been resolved yet.
+         * Every other failure hands back the envelope it has, and an incomplete one still latches.
          */
         await registry.importCrossingProvenance(
-          !executed && !executionResult
-            ? emptyResolvedSecretTraceProvenance()
-            : executionResult?.executionState?.resolvedSecretTraceProvenance,
+          executionResult
+            ? executionResult.executionState?.resolvedSecretTraceProvenance
+            : emptyResolvedSecretTraceProvenance(),
           {
             output: executionResult?.output,
             logs: executionResult?.logs,

apps/sim/lib/workflows/executor/execute-workflow.ts

@@ -13,6 +13,7 @@ import { handlePostExecutionPauseState } from '@/lib/workflows/executor/pause-pe
 import { ExecutionSnapshot } from '@/executor/execution/snapshot'
 import type { ExecutionMetadata, SerializableExecutionState } from '@/executor/execution/types'
 import type { ExecutionResult, StreamingExecution } from '@/executor/types'
+import { attachExecutionResult, hasExecutionResult } from '@/executor/utils/errors'
 import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 import type { CoreTriggerType } from '@/stores/logs/filters/types'
 
@@ -128,6 +129,12 @@ export async function executeWorkflow(
     loggingSession.setTrustedExecutionCorrelation(streamConfig.trustedExecutionCorrelation)
   }
   let postExecutionOwnershipTransferred = false
+  /**
+   * Held outside the `try` so the catch can carry it. The executor attaches its result when the
+   * run itself throws, but the post-execution work below can throw after a run has already
+   * produced one — and callers read a missing result as proof that no block ran.
+   */
+  let executionResult: ExecutionResult | undefined
 
   try {
     const metadata: ExecutionMetadata = {
@@ -169,7 +176,7 @@ export async function executeWorkflow(
 
     const executionStartMs = Date.now()
 
-    const result = await executeWorkflowCore({
+    const result = (executionResult = await executeWorkflowCore({
       snapshot,
       callbacks: {
         onStream: streamConfig?.onStream,
@@ -197,7 +204,7 @@ export async function executeWorkflow(
       trustedInitialResolvedSecretTraceProvenance:
         streamConfig?.trustedInitialResolvedSecretTraceProvenance,
       runFromBlock: streamConfig?.runFromBlock,
-    })
+    }))
 
     const blockTypes = [
       ...new Set(
@@ -241,6 +248,15 @@ export async function executeWorkflow(
 
     return result
   } catch (error: unknown) {
+    /**
+     * Carries the run's result on a failure raised after it produced one — the post-execution
+     * work below the executor call can throw, and callers read a missing result as proof that no
+     * block ran. Skipped when the executor already attached its own, which is the more specific
+     * record, and when the throw is not an object to carry it.
+     */
+    if (executionResult && error instanceof Error && !hasExecutionResult(error)) {
+      attachExecutionResult(error, executionResult)
+    }
     const errorDiagnostic = loggingSession.projectDiagnosticError(error)
     logger.error(`[${requestId}] Workflow execution failed`, errorDiagnostic)