@contextecf/guardian-cli 0.1.0 → 0.1.2

package/dist/packages/guardian-cli/src/bin.js

@@ -15741,8 +15741,7 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 import { readFileSync } from "node:fs";
 import { copyFile, mkdir, readFile, stat } from "node:fs/promises";
 import path from "node:path";
-import Database from "better-sqlite3";
-import PageEncryptedDatabase from "better-sqlite3-multiple-ciphers";
+import SQLiteDatabase from "better-sqlite3-multiple-ciphers";
 function migrateSQLitePersonalFabricStore(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS guardian_ecl_events (
@@ -16047,12 +16046,12 @@ function buildSQLitePersonalFabricStorePageEncryption(options) {
 }
 function openSQLitePersonalFabricDatabase(databasePath, pageEncryption) {
   if (!pageEncryption) {
-    return new Database(databasePath ?? ":memory:");
+    return new SQLiteDatabase(databasePath ?? ":memory:");
   }
   if (!databasePath) {
     throw new Error("Guardian SQLite page encryption requires a filesystem database path.");
   }
-  const db = new PageEncryptedDatabase(databasePath);
+  const db = new SQLiteDatabase(databasePath);
   if (pageEncryption.cipher === "sqlcipher") {
     db.pragma(`cipher=${sqliteStringLiteral("sqlcipher")}`);
     db.pragma(`legacy=${pageEncryption.legacy ?? 4}`);
@@ -17594,7 +17593,7 @@ async function runStartCommand(flags, options) {
   const home = resolveGuardianHome(options.env, options.platform);
   const profile = await readProfile(home);
   if (!profile) {
-    write(stderr, "Guardian is not installed. Run guardian install first.\n");
+    write(stderr, "Guardian is not installed. Run guardian setup first.\n");
     return 1;
   }
   const host = stringFlag(flags, "host") ?? "127.0.0.1";
@@ -17602,10 +17601,8 @@ async function runStartCommand(flags, options) {
     write(stderr, "Guardian start only accepts loopback hosts: 127.0.0.1, localhost, or ::1.\n");
     return 1;
   }
-  const port = numberFlag(flags, "port") ?? 4317;
-  const requestedDaemonUrl = formatDaemonBaseUrl(host, port);
-  const requestedControlTowerUrl = `${requestedDaemonUrl}/control-tower`;
-  const controlTowerSource = host === "127.0.0.1" && port === 4317 ? "default_loopback" : "env_or_flag";
+  const explicitPort = numberFlag(flags, "port");
+  const port = explicitPort ?? 4317;
   let token;
   try {
     token = await readRuntimeToken(home);
@@ -17617,14 +17614,66 @@ async function runStartCommand(flags, options) {
     );
     return 1;
   }
-  const healthUrl = resolveDaemonHealthUrl(requestedControlTowerUrl);
-  if (!healthUrl.ok) {
-    write(stderr, `${healthUrl.error}
+  const healthChecker = options.healthDaemon ?? requestGuardianDaemonHealth;
+  const candidates = explicitPort ? [explicitPort] : Array.from({ length: 8 }, (_, index) => port + index);
+  let selected;
+  let firstTokenMismatch;
+  for (const candidatePort of candidates) {
+    const requestedDaemonUrl2 = formatDaemonBaseUrl(host, candidatePort);
+    const requestedControlTowerUrl2 = `${requestedDaemonUrl2}/control-tower`;
+    const controlTowerSource2 = host === "127.0.0.1" && candidatePort === 4317 ? "default_loopback" : "env_or_flag";
+    const healthUrl2 = resolveDaemonHealthUrl(requestedControlTowerUrl2);
+    if (!healthUrl2.ok) {
+      write(stderr, `${healthUrl2.error}
 `);
+      return 1;
+    }
+    const existing2 = await healthChecker({ url: healthUrl2.url, token });
+    if (existing2.ok && existing2.reachable) {
+      selected = {
+        port: candidatePort,
+        requestedDaemonUrl: requestedDaemonUrl2,
+        requestedControlTowerUrl: requestedControlTowerUrl2,
+        healthUrl: healthUrl2.url,
+        controlTowerSource: controlTowerSource2,
+        existing: existing2
+      };
+      break;
+    }
+    if (existing2.statusCode === 401) {
+      firstTokenMismatch ??= {
+        requestedDaemonUrl: requestedDaemonUrl2,
+        port: candidatePort,
+        healthUrl: healthUrl2.url,
+        existing: existing2
+      };
+      if (explicitPort) {
+        write(stderr, renderDaemonTokenMismatchMessage(requestedDaemonUrl2, candidatePort));
+        return 1;
+      }
+      continue;
+    }
+    selected = {
+      port: candidatePort,
+      requestedDaemonUrl: requestedDaemonUrl2,
+      requestedControlTowerUrl: requestedControlTowerUrl2,
+      healthUrl: healthUrl2.url,
+      controlTowerSource: controlTowerSource2,
+      existing: existing2
+    };
+    break;
+  }
+  if (!selected) {
+    const mismatch = firstTokenMismatch ?? {
+      requestedDaemonUrl: formatDaemonBaseUrl(host, port),
+      port,
+      healthUrl: `${formatDaemonBaseUrl(host, port)}/v1/guardian/admin/health`,
+      existing: { ok: false, reachable: false, statusCode: 401, error: "unauthorized" }
+    };
+    write(stderr, renderDaemonTokenMismatchMessage(mismatch.requestedDaemonUrl, mismatch.port));
     return 1;
   }
-  const healthChecker = options.healthDaemon ?? requestGuardianDaemonHealth;
-  const existing = await healthChecker({ url: healthUrl.url, token });
+  const { requestedDaemonUrl, requestedControlTowerUrl, healthUrl, controlTowerSource, existing } = selected;
   if (existing.ok && existing.reachable) {
     profile.runtime.daemon_status = "start_requested";
     profile.control_tower = {
@@ -17638,7 +17687,7 @@ async function runStartCommand(flags, options) {
       daemonStatus: profile.runtime.daemon_status,
       daemonUrl: requestedDaemonUrl,
       controlTowerUrl: requestedControlTowerUrl,
-      healthUrl: healthUrl.url,
+      healthUrl,
       healthStatus: "reachable",
       nextCommands: ["guardian open", "guardian status", "guardian daemon pair --json"]
     };
@@ -17655,20 +17704,12 @@ async function runStartCommand(flags, options) {
     );
     return 0;
   }
-  if (existing.statusCode === 401) {
-    write(
-      stderr,
-      `Guardian daemon at ${requestedDaemonUrl} rejected the local runtime token. Run guardian status or guardian stop before starting another daemon.
-`
-    );
-    return 1;
-  }
   if (!options.startDetachedDaemon) {
     write(stderr, "Guardian detached daemon launcher is unavailable in this runtime.\n");
     return 1;
   }
-  const started = await options.startDetachedDaemon({ home, host, port });
-  const daemonUrl = normalizeDaemonBaseUrl(started.url, host, port);
+  const started = await options.startDetachedDaemon({ home, host, port: selected.port });
+  const daemonUrl = normalizeDaemonBaseUrl(started.url, host, selected.port);
   const controlTowerUrl = `${daemonUrl}/control-tower`;
   profile.runtime.daemon_status = "start_requested";
   profile.control_tower = {
@@ -17683,7 +17724,7 @@ async function runStartCommand(flags, options) {
     daemonUrl,
     controlTowerUrl,
     pid: started.pid,
-    healthUrl: healthUrl.url,
+    healthUrl,
     healthStatus: existing.error ? "unreachable" : "not_reachable",
     nextCommands: ["guardian open", "guardian status", "guardian daemon pair --json"]
   };
@@ -17701,6 +17742,15 @@ async function runStartCommand(flags, options) {
   );
   return 0;
 }
+function renderDaemonTokenMismatchMessage(requestedDaemonUrl, port) {
+  return [
+    `Guardian found another daemon or container at ${requestedDaemonUrl}, but it rejected this profile's local runtime token.`,
+    "This usually means an older Guardian daemon or Docker demo is still using the port.",
+    `Recovery: stop the other process/container, or run Guardian on a different port with guardian launch --port=${port + 1}.`,
+    `Diagnostics: guardian status; docker ps --filter publish=${port}`,
+    ""
+  ].join("\n");
+}
 async function runStopCommand(flags, options) {
   const stdout = options.stdout ?? process.stdout;
   const stderr = options.stderr ?? process.stderr;
@@ -22236,7 +22286,7 @@ var init_runtime = __esm({
     "use strict";
     init_src();
     init_src2();
-    GUARDIAN_CLI_VERSION = "0.1.0";
+    GUARDIAN_CLI_VERSION = "0.1.2";
     GUARDIAN_PROFILE_SCHEMA_VERSION = "contextecf/project-guardian-profile/v1";
     GUARDIAN_NPM_PACKAGE_NAME = "@contextecf/guardian-cli";
     GUARDIAN_GLOBAL_INSTALL_COMMAND = `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}`;
@@ -22999,6 +23049,14 @@ function detectRisk(promptManifest, policyPacks) {
     risks.add("pii");
     matchedPolicyRefs.push("guardian:builtin:pii-detection");
   }
+  if (containsFullSsn(prompt)) {
+    risks.add("pii");
+    matchedPolicyRefs.push("guardian:builtin:ssn-detection");
+    matchedPolicyRefs.push("guardian:builtin:ssn-full-value");
+  } else if (SSN_CONTEXT_PATTERN.test(prompt)) {
+    risks.add("pii");
+    matchedPolicyRefs.push("guardian:builtin:ssn-detection");
+  }
   if (FINANCIAL_PATTERN.test(prompt)) {
     risks.add("financial_data");
     matchedPolicyRefs.push("guardian:builtin:financial-data");
@@ -23030,7 +23088,7 @@ function detectRisk(promptManifest, policyPacks) {
     }
   }
   const detectedRisks = Array.from(risks);
-  const riskTier = tierForRisks(detectedRisks);
+  const riskTier = hasFullSsnRisk(matchedPolicyRefs) ? "high" : tierForRisks(detectedRisks);
   const recommendedDisposition = recommendedDispositionForTier(
     riskTier,
     detectedRisks,
@@ -23057,6 +23115,9 @@ function decideDisposition(session, promptManifest, policyPacks, riskReport) {
   if (riskReport.detected_risks.includes("secret") || riskReport.detected_risks.includes("prompt_injection")) {
     return "block";
   }
+  if (hasFullSsnRisk(riskReport.matched_policy_refs)) {
+    return promptCoachEnabled(policyPacks) ? "rewrite" : "block";
+  }
   const thresholds = effectiveRiskThresholds(policyPacks);
   if (riskTierRank(riskReport.risk_tier) >= riskTierRank(thresholds.block_at)) {
     return "block";
@@ -23116,6 +23177,7 @@ function buildFinalPrompt(prompt, disposition, riskReport) {
     );
   }
   if (riskReport.detected_risks.includes("pii")) {
+    rewritten = rewritten.replace(SSN_PATTERN, "XXX-XX-$3");
     rewritten = rewritten.replace(EMAIL_PATTERN, "[REDACTED_EMAIL]");
   }
   return rewritten;
@@ -23129,11 +23191,12 @@ function buildCoachCard(disposition, riskReport, policyPacks, learningSignals) {
   if (!coachDecision.should_present_card || coachDecision.intervention_level === "none") {
     return void 0;
   }
+  const fullSsnRisk = hasFullSsnRisk(riskReport.matched_policy_refs);
   const card = {
     card_id: `coach:${riskReport.risk_report_id}`,
     intervention_level: coachDecision.intervention_level,
-    title: disposition === "block" ? "Guardian blocked this prompt" : disposition === "confirm" ? "Guardian needs your confirmation" : coachDecision.intervention_level === "soft_tag_along" ? "Guardian found useful context" : "Guardian can improve this prompt",
-    body: disposition === "confirm" ? "This prompt includes higher-risk content and needs confirmation before it leaves your machine." : coachDecision.intervention_level === "soft_tag_along" ? "This prompt may work better with a little more local context attached first." : "Guardian found context or privacy improvements that may make this prompt safer and more useful.",
+    title: disposition === "block" ? "Guardian blocked this prompt" : disposition === "confirm" ? "Guardian needs your confirmation" : coachDecision.intervention_level === "soft_tag_along" ? "Guardian found useful context" : fullSsnRisk ? "Guardian found an identity number" : "Guardian can improve this prompt",
+    body: disposition === "confirm" ? "This prompt includes higher-risk content and needs confirmation before it leaves your machine." : coachDecision.intervention_level === "soft_tag_along" ? "This prompt may work better with a little more local context attached first." : fullSsnRisk ? "Guardian can mask the Social Security number before anything leaves your machine." : "Guardian found context or privacy improvements that may make this prompt safer and more useful.",
     recommended_choice_id: disposition === "confirm" ? "confirm-after-review" : coachDecision.intervention_level === "soft_tag_along" ? "add-context" : "use-guardian-version",
     choices: disposition === "confirm" ? [
       {
@@ -23163,6 +23226,20 @@ function buildCoachCard(disposition, riskReport, policyPacks, learningSignals) {
         description: "Send without adding context.",
         resulting_disposition: "allow"
       }
+    ] : fullSsnRisk ? [
+      {
+        choice_id: "use-guardian-version",
+        label: "Use masked prompt",
+        description: "Replace the Social Security number with XXX-XX-1234 before sending.",
+        recommended: true,
+        resulting_disposition: "rewrite"
+      },
+      {
+        choice_id: "cancel",
+        label: "Cancel",
+        description: "Do not send this prompt.",
+        resulting_disposition: "block"
+      }
     ] : [
       {
         choice_id: "use-guardian-version",
@@ -23262,6 +23339,13 @@ function promptCoachEnabled(policyPacks) {
 function isDestructiveTool(toolName) {
   return /\b(delete|drop|send|publish|pay|write|exec|shell|migration)\b/i.test(toolName);
 }
+function containsFullSsn(prompt) {
+  SSN_PATTERN.lastIndex = 0;
+  return SSN_PATTERN.test(prompt);
+}
+function hasFullSsnRisk(policyRefs) {
+  return policyRefs.includes("guardian:builtin:ssn-full-value");
+}
 function createPolicyPackPreset(overrides) {
   return {
     version: POLICY_PACK_PRESET_VERSION,
@@ -23357,7 +23441,7 @@ function digest2(value) {
 function isPresent(value) {
   return value !== void 0;
 }
-var DEFAULT_RISK_THRESHOLDS, POLICY_PACK_PRESET_VERSION, HIGH_RISK_TERMS, SECRET_PATTERNS, EMAIL_PATTERN, FINANCIAL_PATTERN, HEALTHCARE_PATTERN, WORK_PATTERN, PROMPT_INJECTION_PATTERN, GUARDIAN_POLICY_PACK_PRESETS;
+var DEFAULT_RISK_THRESHOLDS, POLICY_PACK_PRESET_VERSION, HIGH_RISK_TERMS, SECRET_PATTERNS, EMAIL_PATTERN, SSN_PATTERN, SSN_CONTEXT_PATTERN, FINANCIAL_PATTERN, HEALTHCARE_PATTERN, WORK_PATTERN, PROMPT_INJECTION_PATTERN, GUARDIAN_POLICY_PACK_PRESETS;
 var init_src3 = __esm({
   "packages/personal-fabric-runtime/src/index.ts"() {
     "use strict";
@@ -23378,6 +23462,8 @@ var init_src3 = __esm({
       /\b(password|secret|token)\s*[:=]\s*\S+/i
     ];
     EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+    SSN_PATTERN = /\b(?!000|666|9\d\d)(\d{3})[-\s]?(?!00)(\d{2})[-\s]?(?!0000)(\d{4})\b/g;
+    SSN_CONTEXT_PATTERN = /\b(ssn|social security(?: number)?)\b/i;
     FINANCIAL_PATTERN = /\b(bank|wire|routing number|account number|payroll|invoice|revenue|forecast|contract value|credit card)\b/i;
     HEALTHCARE_PATTERN = /\b(patient|diagnosis|medication|hipaa|medical record|prescription|clinical)\b/i;
     WORK_PATTERN = /\b(contract|client|customer|salesforce|pipeline|renewal|board|employee|confidential)\b/i;
@@ -24811,6 +24897,7 @@ __export(daemon_exports, {
   buildControlTowerLocalDataStatus: () => buildControlTowerLocalDataStatus,
   buildControlTowerReleaseDoctorStatus: () => buildControlTowerReleaseDoctorStatus,
   processGuardianBrowserBridgeRequest: () => processGuardianBrowserBridgeRequest,
+  processGuardianControlTowerActivityRequest: () => processGuardianControlTowerActivityRequest,
   processGuardianControlTowerAppPermissionRequest: () => processGuardianControlTowerAppPermissionRequest,
   processGuardianControlTowerDataRequest: () => processGuardianControlTowerDataRequest,
   processGuardianControlTowerPolicyRequest: () => processGuardianControlTowerPolicyRequest,
@@ -24974,6 +25061,14 @@ async function handleRequest(input2) {
     );
     return;
   }
+  const activityUrl = parseGuardianUrl(input2.request.url);
+  if (input2.request.method === "GET" && activityUrl?.pathname === "/v1/guardian/activity") {
+    const filter = parseActivityFilter(activityUrl.searchParams.get("filter") ?? "all");
+    const receipts = (await input2.store.listReceipts()).slice().sort((left, right) => right.created_at.localeCompare(left.created_at)).slice(0, CONTROL_TOWER_RECEIPT_LIMIT);
+    const result2 = processGuardianControlTowerActivityRequest(receipts, filter);
+    writeJson(input2.response, result2.statusCode, result2.body);
+    return;
+  }
   if (input2.request.method === "GET" && input2.request.url === "/v1/guardian/admin/health") {
     const result2 = processGuardianDaemonHealthRequest({
       token: input2.token,
@@ -25130,6 +25225,20 @@ function processGuardianDaemonHealthRequest(input2) {
     }
   };
 }
+function processGuardianControlTowerActivityRequest(receipts, filterValue) {
+  const filter = parseActivityFilter(filterValue);
+  return {
+    statusCode: 200,
+    body: {
+      ok: true,
+      schema_version: "contextecf/project-guardian-control-tower-activity/v1",
+      filter,
+      raw_content_included: false,
+      token_printed: false,
+      activities: buildActivityItems(receipts, filter)
+    }
+  };
+}
 function processGuardianDaemonStopRequest(input2) {
   if (!isAuthorized(input2.token, input2.suppliedToken)) {
     return {
@@ -25920,12 +26029,31 @@ function closeGuardianDaemonServer(server) {
   } catch {
   }
 }
+function parseGuardianUrl(url2) {
+  if (!url2) {
+    return void 0;
+  }
+  try {
+    return new URL(url2, "http://127.0.0.1");
+  } catch {
+    return void 0;
+  }
+}
 function renderControlTowerStatusPage(profile, receipts = [], searchGraph = { nodes: [], edges: [] }, learningEvents = [], localDataStatus = createEmptyControlTowerLocalDataStatus(profile), releaseDoctorStatus = createEmptyControlTowerReleaseDoctorStatus(
   profile
 )) {
   const policyPacks = profile.policy_packs.available.length;
   const activePolicyPacks = profile.policy_packs.active.join(", ") || "none";
   const recentReceipts = receipts.slice().sort((left, right) => right.created_at.localeCompare(left.created_at)).slice(0, CONTROL_TOWER_RECEIPT_LIMIT);
+  const blockedReceipts = recentReceipts.filter(
+    (receipt) => receipt.disposition === "block"
+  ).length;
+  const riskyReceipts = recentReceipts.filter(
+    (receipt) => receipt.disposition === "warn" || receipt.disposition === "confirm"
+  ).length;
+  const allowedReceipts = recentReceipts.filter(
+    (receipt) => receipt.disposition === "allow"
+  ).length;
   const receiptRows = renderReceiptRows(recentReceipts);
   const graphNodes = searchGraph.nodes.slice(0, CONTROL_TOWER_GRAPH_NODE_LIMIT);
   const graphEdges = searchGraph.edges.slice(0, CONTROL_TOWER_GRAPH_EDGE_LIMIT);
@@ -26005,6 +26133,92 @@ function renderControlTowerStatusPage(profile, receipts = [], searchGraph = { no
   ).join("\n");
   const privacyDefaults = profile.privacy.privacy_mode_enabled && !profile.privacy.raw_content_capture_enabled && !profile.privacy.cloud_sync_enabled && !profile.privacy.local_app_autopilot_enabled ? "on" : "needs review";
   const promptCoachBudget = profile.learning_graph.prompt_coach_interruption_budget;
+  const protectedState = releaseDoctorStatus.doctor.checkCounts.fail === 0 && privacyDefaults === "on";
+  const protectedStateLabel = protectedState ? "You're Protected" : "Needs Review";
+  const protectedStateDetail = protectedState ? "Guardian is running locally with metadata-only privacy defaults." : "Guardian is running, but one or more install checks need attention.";
+  const protectionRingClass = protectedState ? "protection-ring is-protected" : "protection-ring";
+  const heroMetrics = [
+    {
+      label: "Threats blocked",
+      value: String(blockedReceipts),
+      detail: "Recent metadata receipts",
+      tone: "blocked"
+    },
+    {
+      label: "Risky prompts flagged",
+      value: String(riskyReceipts),
+      detail: "Warn or confirmation decisions",
+      tone: "flagged"
+    },
+    {
+      label: "Safe actions approved",
+      value: String(allowedReceipts),
+      detail: "Allowed recent decisions",
+      tone: "allowed"
+    },
+    {
+      label: "AI tools watched",
+      value: String(providerPermissionRows.length),
+      detail: `${appPermissionRows.length} local app permission surface(s)`,
+      tone: "watched"
+    }
+  ];
+  const heroMetricCards = heroMetrics.map(
+    (metric) => `            <article class="metric-card metric-${escapeHtml(metric.tone)}">
+              <div class="metric-value">${escapeHtml(metric.value)}</div>
+              <div class="metric-label">${escapeHtml(metric.label)}</div>
+              <div class="metric-detail">${escapeHtml(metric.detail)}</div>
+            </article>`
+  ).join("\n");
+  const activityFeedHtml = renderActivityFeed(recentReceipts);
+  const postureCardsHtml = GUARDIAN_POSTURE_PROFILE_CATALOG.map((postureProfile) => {
+    const selected = profile.posture_profile.selected === postureProfile.id;
+    const icon = postureProfile.id === "calm" ? "&#9790;" : postureProfile.id === "balanced" ? "&#9878;" : postureProfile.id === "guided" ? "&#127891;" : postureProfile.id === "high_assurance" ? "&#128274;" : "&#9881;";
+    return `          <form class="posture-card${selected ? " is-active" : ""}" method="post" action="/v1/guardian/admin/preferences">
+            <input type="hidden" name="postureProfileId" value="${escapeHtml(postureProfile.id)}">
+            <button type="submit" class="posture-button" ${selected || profile.posture_profile.managed ? "disabled" : ""}>
+              <span class="posture-icon">${icon}</span>
+              <span class="posture-title">${escapeHtml(postureProfile.displayName)}</span>
+              <span class="posture-summary">${escapeHtml(postureProfile.summary)}</span>
+              ${selected ? '<span class="posture-state">ACTIVE</span>' : '<span class="posture-state">Use this setting</span>'}
+            </button>
+          </form>`;
+  }).join("\n");
+  const privacySettingRowsHtml = [
+    {
+      label: "Privacy mode",
+      detail: "Never stores your actual prompts",
+      enabled: profile.privacy.privacy_mode_enabled,
+      control: renderOutcomePrivacyModeControl(profile.privacy.privacy_mode_enabled)
+    },
+    {
+      label: "Prompt coaching",
+      detail: "Tips to improve your AI requests",
+      enabled: profile.prompt_coach_mode !== "off",
+      control: renderOutcomePromptCoachControl(profile.prompt_coach_mode)
+    },
+    {
+      label: "Stays on this device",
+      detail: "All data kept local, never synced",
+      enabled: !profile.privacy.cloud_sync_enabled,
+      control: '<span class="toggle is-on" aria-label="Stays on this device on"><span></span></span>'
+    }
+  ].map(
+    (setting) => `            <div class="setting-row">
+              <div>
+                <h3>${escapeHtml(setting.label)}</h3>
+                <p>${escapeHtml(setting.detail)}</p>
+              </div>
+              ${setting.control}
+            </div>`
+  ).join("\n");
+  const providerPillsHtml = providerPermissionRows.filter((row) => row.state !== "revoked").map(
+    (row) => `            <form method="post" action="/v1/guardian/admin/provider-permission" class="provider-pill-form">
+              <input type="hidden" name="action" value="revoke">
+              <input type="hidden" name="providerId" value="${escapeHtml(row.id)}">
+              <button type="submit" class="provider-pill" aria-label="Revoke ${escapeHtml(providerDisplayName(row.id))}"><span></span>${escapeHtml(providerDisplayName(row.id))}</button>
+            </form>`
+  ).join("\n");
   const rows = [
     ["Profile", profile.profile_dir],
     ["Daemon", profile.runtime.daemon_status],
@@ -26057,53 +26271,464 @@ function renderControlTowerStatusPage(profile, receipts = [], searchGraph = { no
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Project Guardian Control Tower</title>
     <style>
-      :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-      body { margin: 0; background: #f7f8f3; color: #171916; }
-      main { max-width: 860px; margin: 0 auto; padding: 40px 20px; }
-      h1 { margin: 0 0 8px; font-size: 32px; line-height: 1.1; }
-      h2 { margin: 28px 0 8px; font-size: 20px; line-height: 1.2; }
-      p { margin: 0 0 24px; color: #4d5249; }
-      section { margin-top: 28px; }
-      table { width: 100%; border-collapse: collapse; background: #ffffff; border: 1px solid #d8ddd1; }
-      th, td { padding: 12px 14px; border-bottom: 1px solid #e7eadf; text-align: left; vertical-align: top; }
-      th { width: 190px; color: #2f372b; font-weight: 650; }
-      code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 13px; }
+      :root {
+        color-scheme: dark;
+        font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        background: #070c16;
+        color: #f6f8ff;
+      }
+      * { box-sizing: border-box; }
+      body {
+        min-height: 100vh;
+        margin: 0;
+        background:
+          radial-gradient(circle at 18% 12%, rgba(46, 184, 122, 0.16), transparent 30%),
+          radial-gradient(circle at 85% 18%, rgba(79, 126, 255, 0.12), transparent 32%),
+          linear-gradient(180deg, #0a111f 0%, #070c16 52%, #050812 100%);
+        color: #f6f8ff;
+      }
+      body::before {
+        position: fixed;
+        inset: 0;
+        z-index: -1;
+        content: "";
+        background-image:
+          linear-gradient(rgba(255, 255, 255, 0.025) 1px, transparent 1px),
+          linear-gradient(90deg, rgba(255, 255, 255, 0.025) 1px, transparent 1px);
+        background-size: 44px 44px;
+        mask-image: linear-gradient(to bottom, rgba(0, 0, 0, 0.55), transparent 72%);
+      }
+      main { max-width: 1180px; margin: 0 auto; padding: 104px 20px 56px; }
+      h1 { margin: 0 0 10px; font-size: clamp(34px, 5vw, 64px); line-height: 1; letter-spacing: 0; }
+      h2 { margin: 0 0 10px; font-size: 22px; line-height: 1.2; letter-spacing: 0; }
+      p { margin: 0 0 20px; color: #aab4c5; }
+      section {
+        margin-top: 24px;
+        padding: 22px;
+        border: 1px solid rgba(148, 163, 184, 0.18);
+        border-radius: 8px;
+        background: rgba(12, 20, 34, 0.82);
+        box-shadow: 0 20px 60px rgba(0, 0, 0, 0.22);
+      }
+      table { width: 100%; border-collapse: collapse; overflow: hidden; border: 1px solid rgba(148, 163, 184, 0.15); border-radius: 8px; background: rgba(6, 12, 24, 0.62); }
+      th, td { padding: 12px 14px; border-bottom: 1px solid rgba(148, 163, 184, 0.13); text-align: left; vertical-align: top; }
+      th { width: 210px; color: #d8e1f0; font-weight: 650; }
+      td { color: #c8d2e3; overflow-wrap: anywhere; }
+      code { padding: 2px 5px; border-radius: 6px; background: rgba(15, 23, 42, 0.9); color: #d8f8e7; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 13px; }
       form { margin: 0; }
-      button { min-width: 96px; min-height: 34px; border: 1px solid #7b8d70; border-radius: 6px; background: #eef5e9; color: #172211; font: inherit; font-weight: 650; cursor: pointer; }
-      button:hover { background: #e2eed8; }
+      button { min-width: 96px; min-height: 34px; border: 1px solid rgba(69, 201, 126, 0.44); border-radius: 8px; background: rgba(24, 96, 62, 0.62); color: #ecfff4; font: inherit; font-weight: 650; cursor: pointer; }
+      button:hover { background: rgba(39, 132, 82, 0.72); }
       button[disabled] { cursor: default; opacity: 0.56; }
+      input {
+        min-height: 34px;
+        max-width: 100%;
+        border: 1px solid rgba(148, 163, 184, 0.24);
+        border-radius: 8px;
+        background: rgba(8, 13, 24, 0.92);
+        color: #f6f8ff;
+        padding: 7px 9px;
+      }
       details { max-width: 100%; }
-      summary { cursor: pointer; font-weight: 650; }
+      summary { cursor: pointer; font-weight: 650; color: #eff6ff; }
       dl { display: grid; grid-template-columns: minmax(120px, 180px) 1fr; gap: 8px 14px; margin: 12px 0 0; }
-      dt { color: #596052; font-weight: 650; }
-      dd { margin: 0; overflow-wrap: anywhere; }
+      dt { color: #8fa0b7; font-weight: 650; }
+      dd { margin: 0; overflow-wrap: anywhere; color: #c8d2e3; }
       tr:last-child th, tr:last-child td { border-bottom: 0; }
-      .badge { display: inline-block; margin-bottom: 16px; padding: 5px 9px; border: 1px solid #91a582; color: #26341f; background: #e8f1df; font-size: 13px; }
-      @media (prefers-color-scheme: dark) {
-        body { background: #10130f; color: #f2f4ee; }
-        p { color: #bdc5b6; }
-        table { background: #181d16; border-color: #333b2f; }
-        th, td { border-bottom-color: #2b3228; }
-        th { color: #dce6d2; }
-        dt { color: #aeb8a6; }
-        button { background: #263520; border-color: #58724d; color: #f2f7ec; }
-        button:hover { background: #314629; }
-        .badge { background: #20311d; border-color: #496642; color: #dbeed0; }
+      .topbar {
+        position: fixed;
+        top: 0;
+        right: 0;
+        left: 0;
+        z-index: 10;
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        min-height: 68px;
+        padding: 0 24px;
+        border-bottom: 1px solid rgba(148, 163, 184, 0.13);
+        background: rgba(7, 12, 22, 0.78);
+        backdrop-filter: blur(18px);
+      }
+      .brand, .topbar-actions, .status-pill, .activity-heading, .filter-chips {
+        display: flex;
+        align-items: center;
+      }
+      .brand { gap: 10px; color: #f8fbff; font-size: 18px; font-weight: 750; }
+      .brand-mark {
+        display: inline-grid;
+        place-items: center;
+        width: 34px;
+        height: 34px;
+        border-radius: 8px;
+        background: linear-gradient(145deg, #22c55e, #128452);
+        color: #02120b;
+        font-weight: 900;
+        box-shadow: 0 0 22px rgba(34, 197, 94, 0.34);
+      }
+      .topbar-actions { gap: 10px; }
+      .status-pill {
+        gap: 8px;
+        min-height: 34px;
+        padding: 0 12px;
+        border: 1px solid rgba(34, 197, 94, 0.26);
+        border-radius: 999px;
+        background: rgba(10, 40, 28, 0.86);
+        color: #c9f8d8;
+        font-size: 14px;
+        font-weight: 650;
+      }
+      .status-dot { width: 8px; height: 8px; border-radius: 999px; background: #22c55e; box-shadow: 0 0 14px rgba(34, 197, 94, 0.9); }
+      .icon-button {
+        display: inline-grid;
+        place-items: center;
+        width: 34px;
+        height: 34px;
+        border: 1px solid rgba(148, 163, 184, 0.2);
+        border-radius: 8px;
+        color: #d8e1f0;
+        background: rgba(15, 23, 42, 0.78);
+        font-size: 16px;
+      }
+      .eyebrow {
+        width: fit-content;
+        margin-bottom: 16px;
+        padding: 6px 10px;
+        border: 1px solid rgba(46, 184, 122, 0.35);
+        border-radius: 999px;
+        color: #9cf2bf;
+        background: rgba(16, 82, 55, 0.45);
+        font-size: 13px;
+        font-weight: 700;
+      }
+      .intro { max-width: 720px; font-size: 17px; line-height: 1.55; }
+      .hero-grid {
+        display: grid;
+        grid-template-columns: minmax(280px, 1.05fr) minmax(320px, 0.95fr);
+        gap: 18px;
+        margin-top: 28px;
+      }
+      .protection-card, .metric-card {
+        border: 1px solid rgba(148, 163, 184, 0.17);
+        border-radius: 8px;
+        background: linear-gradient(180deg, rgba(13, 24, 40, 0.92), rgba(8, 14, 26, 0.94));
+        box-shadow: 0 22px 80px rgba(0, 0, 0, 0.28);
+      }
+      .protection-card {
+        display: grid;
+        justify-items: center;
+        align-content: center;
+        min-height: 372px;
+        padding: 38px 24px;
+        text-align: center;
+      }
+      .protection-card h2 { margin-top: 22px; font-size: 30px; }
+      .protection-card p { max-width: 420px; margin-bottom: 0; }
+      .protection-ring {
+        display: grid;
+        place-items: center;
+        width: min(56vw, 218px);
+        aspect-ratio: 1;
+        border: 1px solid rgba(245, 158, 11, 0.48);
+        border-radius: 999px;
+        background:
+          radial-gradient(circle, rgba(245, 158, 11, 0.22) 0%, rgba(245, 158, 11, 0.06) 52%, transparent 70%),
+          conic-gradient(from 20deg, rgba(245, 158, 11, 0.08), rgba(245, 158, 11, 0.8), rgba(245, 158, 11, 0.08));
+        box-shadow: 0 0 64px rgba(245, 158, 11, 0.22);
+      }
+      .protection-ring.is-protected {
+        border-color: rgba(34, 197, 94, 0.48);
+        background:
+          radial-gradient(circle, rgba(34, 197, 94, 0.22) 0%, rgba(34, 197, 94, 0.06) 52%, transparent 70%),
+          conic-gradient(from 20deg, rgba(34, 197, 94, 0.08), rgba(34, 197, 94, 0.86), rgba(34, 197, 94, 0.08));
+        box-shadow: 0 0 72px rgba(34, 197, 94, 0.32);
+      }
+      .ring-core {
+        display: grid;
+        place-items: center;
+        width: 84px;
+        aspect-ratio: 1;
+        border: 1px solid rgba(255, 255, 255, 0.12);
+        border-radius: 999px;
+        background: linear-gradient(145deg, #22c55e, #0f8b57);
+        color: #03140b;
+        font-size: 34px;
+        font-weight: 950;
+      }
+      .metric-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; }
+      .metric-card { min-height: 176px; padding: 22px; }
+      .metric-value { margin-bottom: 8px; color: #e6fff0; font-size: 46px; line-height: 1; font-weight: 850; }
+      .metric-label { color: #f5f7fb; font-size: 16px; font-weight: 760; }
+      .metric-detail { margin-top: 8px; color: #91a1b8; font-size: 13px; line-height: 1.35; }
+      .metric-blocked .metric-value { color: #ff8b8b; }
+      .metric-flagged .metric-value { color: #ffd166; }
+      .metric-allowed .metric-value { color: #70f0a3; }
+      .metric-watched .metric-value { color: #8cc7ff; }
+      .activity-list { display: grid; gap: 14px; }
+      .activity-card {
+        display: grid;
+        grid-template-columns: 64px 1fr auto;
+        gap: 18px;
+        align-items: center;
+        min-height: 96px;
+        padding: 18px 22px;
+        border: 1px solid rgba(148, 163, 184, 0.16);
+        border-radius: 8px;
+        background: rgba(10, 18, 32, 0.82);
+      }
+      .activity-card.block { border-color: rgba(244, 63, 94, 0.26); background: rgba(43, 12, 32, 0.7); }
+      .activity-card.warn, .activity-card.confirm { border-color: rgba(245, 158, 11, 0.28); background: rgba(42, 34, 22, 0.62); }
+      .activity-card.allow, .activity-card.rewrite { border-color: rgba(34, 197, 94, 0.24); background: rgba(7, 36, 32, 0.64); }
+      .activity-icon {
+        display: grid;
+        place-items: center;
+        width: 48px;
+        height: 48px;
+        border-radius: 8px;
+        background: rgba(255, 255, 255, 0.06);
+        font-size: 24px;
+      }
+      .activity-title { color: #f5f7fb; font-size: 17px; font-weight: 780; }
+      .activity-meta { margin-top: 6px; color: #91a1b8; font-size: 14px; font-weight: 650; }
+      .activity-badge {
+        padding: 7px 12px;
+        border: 1px solid rgba(148, 163, 184, 0.22);
+        border-radius: 999px;
+        color: #d8e1f0;
+        font-size: 13px;
+        font-weight: 850;
+      }
+      .activity-badge.block { border-color: rgba(244, 63, 94, 0.42); color: #ff5c7a; background: rgba(244, 63, 94, 0.12); }
+      .activity-badge.warn, .activity-badge.confirm { border-color: rgba(245, 158, 11, 0.42); color: #ffb020; background: rgba(245, 158, 11, 0.12); }
+      .activity-badge.allow, .activity-badge.rewrite { border-color: rgba(34, 197, 94, 0.36); color: #38e678; background: rgba(34, 197, 94, 0.11); }
+      .watch-grid { display: grid; grid-template-columns: minmax(0, 1.35fr) minmax(300px, 0.65fr); gap: 22px; }
+      .posture-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 14px; }
+      .posture-card, .settings-card {
+        min-height: 178px;
+        padding: 22px;
+        border: 1px solid rgba(148, 163, 184, 0.18);
+        border-radius: 8px;
+        background: rgba(11, 24, 40, 0.86);
+      }
+      .posture-card.is-active { border-color: rgba(34, 197, 94, 0.48); background: rgba(6, 45, 37, 0.82); }
+      .posture-button {
+        display: grid;
+        width: 100%;
+        min-width: 0;
+        min-height: 0;
+        padding: 0;
+        border: 0;
+        border-radius: 0;
+        background: transparent;
+        color: inherit;
+        text-align: left;
+        cursor: pointer;
+      }
+      .posture-button:hover { background: transparent; }
+      .posture-button[disabled] { opacity: 1; }
+      .posture-icon { min-height: 32px; color: #e5eefb; font-size: 28px; }
+      .posture-title, .settings-card h3 { margin: 10px 0 8px; color: #f6f8ff; font-size: 19px; font-weight: 820; }
+      .posture-summary, .settings-card p { margin: 0; color: #aab4c5; line-height: 1.5; }
+      .posture-state { margin-top: 14px; color: #38e678; font-size: 13px; font-weight: 900; }
+      .settings-stack { display: grid; gap: 16px; }
+      .setting-row { display: flex; align-items: center; justify-content: space-between; gap: 18px; }
+      .setting-row h3 { margin: 0 0 4px; }
+      .toggle-form { margin: 0; }
+      .toggle {
+        display: inline-flex;
+        align-items: center;
+        width: 56px;
+        height: 32px;
+        min-width: 56px;
+        min-height: 32px;
+        padding: 4px;
+        border: 0;
+        border-radius: 999px;
+        background: rgba(71, 85, 105, 0.55);
+        cursor: pointer;
+      }
+      .toggle:hover { background: rgba(71, 85, 105, 0.7); }
+      .toggle span { width: 24px; height: 24px; border-radius: 999px; background: #d8e1f0; }
+      .toggle.is-on { justify-content: flex-end; background: #22c55e; box-shadow: 0 0 24px rgba(34, 197, 94, 0.28); }
+      .toggle.is-on:hover { background: #27d768; }
+      .toggle[disabled] { cursor: default; opacity: 1; }
+      .provider-list { display: flex; flex-wrap: wrap; gap: 10px; margin-top: 18px; }
+      .provider-pill-form { margin: 0; }
+      .provider-pill {
+        display: inline-flex;
+        align-items: center;
+        gap: 8px;
+        min-width: 0;
+        min-height: 0;
+        padding: 8px 12px;
+        border: 1px solid rgba(148, 163, 184, 0.22);
+        border-radius: 999px;
+        color: #d8e1f0;
+        background: rgba(15, 23, 42, 0.52);
+        font: inherit;
+        font-weight: 750;
+        cursor: pointer;
+      }
+      .provider-pill:hover { background: rgba(30, 41, 59, 0.78); }
+      .provider-pill span { width: 8px; height: 8px; border-radius: 999px; background: #22c55e; }
+      .activity-heading { justify-content: space-between; gap: 16px; margin-bottom: 12px; }
+      .activity-heading h2 { margin: 0; }
+      .filter-chips { gap: 8px; flex-wrap: wrap; }
+      .chip {
+        min-width: auto;
+        min-height: 36px;
+        padding: 6px 10px;
+        border: 1px solid rgba(148, 163, 184, 0.19);
+        border-radius: 999px;
+        color: #aab4c5;
+        background: rgba(15, 23, 42, 0.64);
+        font: inherit;
+        font-size: 13px;
+        font-weight: 700;
+        cursor: pointer;
+      }
+      .chip:hover { color: #f5f7fb; background: rgba(30, 41, 59, 0.78); }
+      .chip.is-active, .chip[aria-pressed="true"] { border-color: rgba(34, 197, 94, 0.38); color: #d7ffe5; background: rgba(21, 128, 61, 0.22); }
+      .activity-card[hidden], .empty-filter-state[hidden] { display: none; }
+      .empty-filter-state {
+        padding: 22px;
+        border: 1px dashed rgba(148, 163, 184, 0.24);
+        border-radius: 8px;
+        color: #aab4c5;
+        background: rgba(15, 23, 42, 0.42);
+      }
+      .detail-panel {
+        margin-top: 24px;
+        border: 1px solid rgba(148, 163, 184, 0.18);
+        border-radius: 8px;
+        background: rgba(12, 20, 34, 0.72);
+        box-shadow: 0 20px 60px rgba(0, 0, 0, 0.2);
+      }
+      .detail-panel > summary {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        gap: 16px;
+        padding: 18px 20px;
+        list-style: none;
+      }
+      .detail-panel > summary::-webkit-details-marker { display: none; }
+      .detail-panel > summary span { color: #f6f8ff; font-size: 18px; font-weight: 820; }
+      .detail-panel > summary small { color: #91a1b8; font-size: 13px; line-height: 1.35; text-align: right; }
+      .detail-panel > summary::after {
+        content: "+";
+        display: grid;
+        place-items: center;
+        width: 28px;
+        height: 28px;
+        flex: 0 0 auto;
+        border: 1px solid rgba(148, 163, 184, 0.2);
+        border-radius: 8px;
+        color: #d8e1f0;
+      }
+      .detail-panel[open] > summary::after { content: "-"; }
+      .panel-body { padding: 0 18px 18px; }
+      .panel-body section:first-child { margin-top: 0; }
+      .visually-hidden {
+        position: absolute;
+        width: 1px;
+        height: 1px;
+        padding: 0;
+        margin: -1px;
+        overflow: hidden;
+        clip: rect(0, 0, 0, 0);
+        white-space: nowrap;
+        border: 0;
+      }
+      @media (max-width: 820px) {
+        main { padding: 92px 14px 40px; }
+        .topbar { padding: 0 14px; }
+        .hero-grid, .metric-grid, .watch-grid, .posture-grid { grid-template-columns: 1fr; }
+        .protection-card { min-height: 320px; }
+        .activity-card { grid-template-columns: 48px 1fr; }
+        .activity-badge { grid-column: 2; width: fit-content; }
+        section { padding: 16px; overflow-x: auto; }
+        table { min-width: 720px; }
+        .activity-heading { align-items: flex-start; flex-direction: column; }
+        .detail-panel > summary { align-items: flex-start; flex-direction: column; }
+        .detail-panel > summary small { text-align: left; }
       }
     </style>
   </head>
   <body>
+    <header class="topbar">
+      <div class="brand"><span class="brand-mark">G</span><span>Guardian</span></div>
+      <div class="topbar-actions">
+        <span class="status-pill"><span class="status-dot"></span>${escapeHtml(profile.runtime.daemon_status)}</span>
+        <span class="icon-button" aria-label="Settings">&#9881;</span>
+      </div>
+    </header>
     <main>
-      <div class="badge">Local-first status</div>
+      <div class="eyebrow">Local-first status</div>
       <h1>Project Guardian Control Tower</h1>
-      <p>This lightweight local page confirms Guardian is running. It shows metadata only and never exposes the runtime token, raw prompts, or raw responses.</p>
-      <table aria-label="Guardian status">
-        <tbody>
+      <p class="intro">This local page confirms Guardian is watching your AI surface with privacy-first, metadata-only governance. It never exposes the runtime token, raw prompts, raw responses, or local action payloads.</p>
+      <div class="hero-grid" aria-label="Guardian protection overview">
+        <article class="protection-card">
+          <div class="${protectionRingClass}"><div class="ring-core">G</div></div>
+          <h2>${escapeHtml(protectedStateLabel)}</h2>
+          <p>${escapeHtml(protectedStateDetail)}</p>
+        </article>
+        <div class="metric-grid">
+${heroMetricCards}
+        </div>
+      </div>
+      <section aria-labelledby="receipt-feed">
+        <div class="activity-heading">
+          <h2 id="receipt-feed">What Guardian did today</h2>
+          <div class="filter-chips" aria-label="Activity filters">
+            <button type="button" class="chip is-active" data-activity-filter="all" aria-pressed="true">All</button>
+            <button type="button" class="chip" data-activity-filter="blocked" aria-pressed="false">Blocked</button>
+            <button type="button" class="chip" data-activity-filter="flagged" aria-pressed="false">Flagged</button>
+            <button type="button" class="chip" data-activity-filter="allowed" aria-pressed="false">Allowed</button>
+          </div>
+        </div>
+        <div class="activity-list" data-activity-list>
+${activityFeedHtml}
+          <div class="empty-filter-state" data-activity-empty hidden>No activity matches this filter yet.</div>
+        </div>
+      </section>
+      <section aria-labelledby="watch-level">
+        <h2 id="watch-level">How closely should Guardian watch?</h2>
+        <div class="watch-grid">
+          <div class="posture-grid">
+${postureCardsHtml}
+          </div>
+          <div class="settings-stack">
+            <article class="settings-card">
+              <h2>Your privacy settings</h2>
+${privacySettingRowsHtml}
+            </article>
+            <article class="settings-card">
+              <h2>AI tools being watched</h2>
+              <p>Guardian monitors these in real time.</p>
+              <div class="provider-list">
+${providerPillsHtml}
+              </div>
+            </article>
+          </div>
+        </div>
+      </section>
+      <details class="detail-panel" aria-labelledby="technical-details-summary">
+        <summary id="technical-details-summary">
+          <span>Technical details</span>
+          <small>Runtime status, policy packs, permissions, local data, release evidence, receipts, Search Graph, and Learning Graph.</small>
+        </summary>
+        <div class="panel-body">
+      <section aria-labelledby="install-snapshot">
+        <h2 id="install-snapshot">Install Snapshot</h2>
+        <p>Quick local runtime, privacy, policy, release, and graph status.</p>
+        <table aria-label="Guardian status">
+          <tbody>
 ${rows.map(
     ([label, value]) => `          <tr><th scope="row">${escapeHtml(label)}</th><td>${escapeHtml(value)}</td></tr>`
   ).join("\n")}
-        </tbody>
-      </table>
+          </tbody>
+        </table>
+      </section>
       <section aria-labelledby="privacy-posture">
         <h2 id="privacy-posture">Privacy Posture</h2>
         <p>Review Guardian's local-first privacy defaults and pending privacy controls without exposing runtime tokens, raw prompts, raw responses, or local action payloads.</p>
@@ -26230,8 +26855,16 @@ ${releaseDoctorRows}
         </table>
       </section>
       <section aria-labelledby="receipt-drilldowns">
-        <h2 id="receipt-drilldowns">Activity &amp; Receipts</h2>
-        <p>Inspect recent Guardian decisions without raw prompt, response, or local-action payload content.</p>
+        <div class="activity-heading">
+          <h2 id="receipt-drilldowns">What Guardian did today</h2>
+          <div class="filter-chips" aria-label="Activity filters">
+            <span class="chip is-active">All</span>
+            <span class="chip">Blocked</span>
+            <span class="chip">Flagged</span>
+            <span class="chip">Allowed</span>
+          </div>
+        </div>
+        <p><span class="visually-hidden">Activity &amp; Receipts.</span>Inspect recent Guardian decisions without raw prompt, response, or local-action payload content.</p>
         <table aria-label="Guardian receipt drilldowns">
           <thead>
             <tr><th scope="col">Receipt</th><th scope="col">Type</th><th scope="col">Decision</th><th scope="col">Details</th></tr>
@@ -26309,7 +26942,79 @@ ${learningEventRows}
           </tbody>
         </table>
       </section>
+        </div>
+      </details>
     </main>
+    <script>
+      (() => {
+        const filters = Array.from(document.querySelectorAll('[data-activity-filter]'));
+        const list = document.querySelector('[data-activity-list]');
+        const emptyState = document.querySelector('[data-activity-empty]');
+        const setSelectedFilter = (selectedFilter) => {
+          for (const filter of filters) {
+            const selected = filter.getAttribute('data-activity-filter') === selectedFilter;
+            filter.classList.toggle('is-active', selected);
+            filter.setAttribute('aria-pressed', selected ? 'true' : 'false');
+          }
+        };
+        const createActivityCard = (activity) => {
+          const card = document.createElement('article');
+          card.className = 'activity-card ' + activity.tone;
+          card.setAttribute('data-activity-state', activity.state);
+          const icon = document.createElement('div');
+          icon.className = 'activity-icon';
+          icon.textContent = activity.icon;
+          const body = document.createElement('div');
+          const title = document.createElement('div');
+          title.className = 'activity-title';
+          title.textContent = activity.title;
+          const meta = document.createElement('div');
+          meta.className = 'activity-meta';
+          meta.textContent = activity.meta;
+          body.append(title, meta);
+          const badge = document.createElement('div');
+          badge.className = 'activity-badge ' + activity.tone;
+          badge.textContent = activity.label;
+          card.append(icon, body, badge);
+          return card;
+        };
+        const renderActivities = (activities) => {
+          if (!list) return;
+          for (const card of Array.from(list.querySelectorAll('[data-activity-state]'))) {
+            card.remove();
+          }
+          for (const activity of activities) {
+            list.insertBefore(createActivityCard(activity), emptyState);
+          }
+          if (emptyState) emptyState.hidden = activities.length > 0;
+        };
+        const applyFilter = async (selectedFilter) => {
+          setSelectedFilter(selectedFilter);
+          const controller = new AbortController();
+          const timeoutId = window.setTimeout(() => controller.abort(), 2500);
+          try {
+            const response = await fetch('/v1/guardian/activity?filter=' + encodeURIComponent(selectedFilter), {
+              headers: { accept: 'application/json' },
+              signal: controller.signal,
+            });
+            if (!response.ok) return;
+            const body = await response.json();
+            if (body && body.ok && Array.isArray(body.activities)) {
+              renderActivities(body.activities);
+            }
+          } catch {
+            // Keep the server-rendered activity feed if a local refresh is unavailable.
+          } finally {
+            window.clearTimeout(timeoutId);
+          }
+        };
+        for (const filter of filters) {
+          filter.addEventListener('click', () => {
+            applyFilter(filter.getAttribute('data-activity-filter') || 'all');
+          });
+        }
+      })();
+    </script>
   </body>
 </html>
 `;
@@ -26323,6 +27028,24 @@ function renderDataPathForm(action, pathName, label) {
     "</form>"
   ].join("");
 }
+function renderOutcomePrivacyModeControl(enabled) {
+  return [
+    '<form method="post" action="/v1/guardian/admin/preferences" class="toggle-form">',
+    '  <input type="hidden" name="privacyModeEnabled" value="on">',
+    `  <button type="submit" class="toggle${enabled ? " is-on" : ""}" aria-label="Privacy mode ${enabled ? "on" : "off"}" ${enabled ? "disabled" : ""}><span></span></button>`,
+    "</form>"
+  ].join("");
+}
+function renderOutcomePromptCoachControl(mode) {
+  const enabled = mode !== "off";
+  const nextMode = enabled ? "off" : "balanced";
+  return [
+    '<form method="post" action="/v1/guardian/admin/preferences" class="toggle-form">',
+    `  <input type="hidden" name="promptCoachMode" value="${escapeHtml(nextMode)}">`,
+    `  <button type="submit" class="toggle${enabled ? " is-on" : ""}" aria-label="Prompt coaching ${enabled ? "on" : "off"}"><span></span></button>`,
+    "</form>"
+  ].join("");
+}
 function renderDataConfirmForm(action, pathName, confirmation, label) {
   return [
     '<form method="post" action="/v1/guardian/admin/data">',
@@ -26661,10 +27384,105 @@ function renderReceiptRows(receipts) {
   }
   return receipts.map((receipt) => renderReceiptRow(receipt)).join("\n");
 }
+function renderActivityFeed(receipts) {
+  if (receipts.length === 0) {
+    return `          <article class="activity-card allow" data-activity-state="allowed">
+            <div class="activity-icon">&#9989;</div>
+            <div>
+              <div class="activity-title">No risky activity recorded yet</div>
+              <div class="activity-meta">Guardian is watching locally</div>
+            </div>
+            <div class="activity-badge allow">READY</div>
+          </article>`;
+  }
+  return receipts.map((receipt) => renderActivityCard(receipt)).join("\n");
+}
+function parseActivityFilter(value) {
+  if (value === "blocked" || value === "flagged" || value === "allowed") {
+    return value;
+  }
+  return "all";
+}
+function buildActivityItems(receipts, filter) {
+  return receipts.filter((receipt) => {
+    const group = activityFilterGroup(receipt.disposition);
+    return filter === "all" || group === filter;
+  }).map((receipt) => ({
+    id: receipt.receipt_id,
+    state: activityFilterGroup(receipt.disposition),
+    tone: activityTone(receipt.disposition),
+    icon: activityPlainIcon(receipt.disposition),
+    title: receipt.summary,
+    meta: `${formatActivityTime(receipt.created_at)} \xB7 ${receipt.receipt_type}`,
+    label: activityLabel(receipt.disposition),
+    raw_content_included: false
+  }));
+}
+function renderActivityCard(receipt) {
+  const tone = activityTone(receipt.disposition);
+  const filterGroup = activityFilterGroup(receipt.disposition);
+  return `          <article class="activity-card ${tone}" data-activity-state="${escapeHtml(filterGroup)}">
+            <div class="activity-icon">${activityIcon(receipt.disposition)}</div>
+            <div>
+              <div class="activity-title">${escapeHtml(receipt.summary)}</div>
+              <div class="activity-meta">${escapeHtml(formatActivityTime(receipt.created_at))} \xB7 ${escapeHtml(receipt.receipt_type)}</div>
+            </div>
+            <div class="activity-badge ${tone}">${escapeHtml(activityLabel(receipt.disposition))}</div>
+          </article>`;
+}
 function renderReceiptRow(receipt) {
   const policyBasis = receipt.policy_basis.length > 0 ? receipt.policy_basis.join(", ") : "none recorded";
   return `          <tr><th scope="row"><code>${escapeHtml(receipt.receipt_id)}</code></th><td>${escapeHtml(receipt.receipt_type)}</td><td>${escapeHtml(receipt.disposition)}</td><td><details><summary>${escapeHtml(receipt.summary)}</summary><dl><dt>Transaction</dt><dd><code>${escapeHtml(receipt.transaction_id)}</code></dd><dt>Created</dt><dd>${escapeHtml(receipt.created_at)}</dd><dt>Policy basis</dt><dd>${escapeHtml(policyBasis)}</dd><dt>Receipt hash</dt><dd><code>${escapeHtml(receipt.receipt_hash)}</code></dd><dt>Raw content</dt><dd>${receipt.raw_content_included ? "included" : "metadata-only"}</dd></dl></details></td></tr>`;
 }
+function activityTone(disposition) {
+  if (disposition === "block") return "block";
+  if (disposition === "warn" || disposition === "confirm") return disposition;
+  return disposition === "rewrite" ? "rewrite" : "allow";
+}
+function activityIcon(disposition) {
+  if (disposition === "block") return "&#128737;";
+  if (disposition === "warn" || disposition === "confirm") return "&#9888;";
+  return "&#9989;";
+}
+function activityPlainIcon(disposition) {
+  if (disposition === "block") return "SHIELD";
+  if (disposition === "warn" || disposition === "confirm") return "!";
+  return "OK";
+}
+function activityLabel(disposition) {
+  if (disposition === "block") return "BLOCKED";
+  if (disposition === "warn") return "FLAGGED";
+  if (disposition === "confirm") return "REVIEW";
+  if (disposition === "rewrite") return "MASKED";
+  return "ALLOWED";
+}
+function activityFilterGroup(disposition) {
+  if (disposition === "block") return "blocked";
+  if (disposition === "warn" || disposition === "confirm") return "flagged";
+  return "allowed";
+}
+function formatActivityTime(createdAt) {
+  const parsed = Date.parse(createdAt);
+  if (Number.isNaN(parsed)) {
+    return createdAt;
+  }
+  return new Date(parsed).toLocaleString("en-US", {
+    dateStyle: "medium",
+    timeStyle: "short",
+    timeZone: "UTC"
+  });
+}
+function providerDisplayName(providerId) {
+  if (providerId === "chatgpt") return "ChatGPT";
+  if (providerId === "claude") return "Claude";
+  if (providerId === "gemini") return "Gemini";
+  if (providerId === "perplexity") return "Perplexity";
+  if (providerId === "cursor") return "Cursor";
+  if (providerId === "windsurf") return "Windsurf";
+  if (providerId === "openrouter") return "OpenRouter";
+  if (providerId === "local_model") return "Local AI";
+  return providerId;
+}
 function buildControlTowerProviderPermissionRows(profile) {
   const revokedProviders = new Set(profile.permissions?.revoked_provider_ids ?? []);
   return GUARDIAN_PROVIDER_IDS.map((providerId) => ({