plugin-scanner 2.0.684__tar.gz → 2.0.685__tar.gz

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.684
+Version: 2.0.685
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/evidence/evidence-filters.test.ts

@@ -89,6 +89,19 @@ assert(byArtifactId.length >= 1 && byArtifactId[0].receipt_id === "r5", "search:
 const byHashPrefix = filterBySearch(ALL, "abcdef78");
 assert(byHashPrefix.length >= 1 && byHashPrefix[0].receipt_id === "r5", "search: artifact_hash prefix");
 
+const bySha256HashPrefix = filterBySearch(
+  [
+    makeReceipt("sha-r1", {
+      artifact_hash: "sha256:2dd8986742cb4f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+    }),
+  ],
+  "2dd8986742cb",
+);
+assert(bySha256HashPrefix.length === 1 && bySha256HashPrefix[0].receipt_id === "sha-r1", "search: sha256 hash prefix");
+
+const byReceiptId = filterBySearch(ALL, "r3");
+assert(byReceiptId.length === 1 && byReceiptId[0].receipt_id === "r3", "search: receipt id");
+
 const noMatch = filterBySearch(ALL, "zzznomatch999");
 assert(noMatch.length === 0, "search: no match returns empty");
 

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/evidence/evidence-filters.ts

@@ -70,23 +70,27 @@ export function filterBySearch(
   return receipts.filter((r) => {
     const name = (r.artifact_name ?? r.artifact_id ?? "").toLowerCase();
     const id = r.artifact_id.toLowerCase();
+    const receiptId = r.receipt_id.toLowerCase();
     const harness = r.harness.toLowerCase();
     const caps = (r.capabilities_summary ?? "").toLowerCase();
     const changed = (r.changed_capabilities ?? []).join(" ").toLowerCase();
     const provenance = (r.provenance_summary ?? "").toLowerCase();
     const scope = (r.source_scope ?? "").toLowerCase();
     const decision = (r.policy_decision ?? "").toLowerCase();
-    const hashPrefix = (r.artifact_hash ?? "").toLowerCase().slice(0, 12);
+    const hashRaw = (r.artifact_hash ?? "").toLowerCase();
+    const hashNormalized = hashRaw.replace(/^sha256:/, "");
     return (
       name.includes(q) ||
       id.includes(q) ||
+      receiptId.includes(q) ||
       harness.includes(q) ||
       caps.includes(q) ||
       changed.includes(q) ||
       provenance.includes(q) ||
       scope.includes(q) ||
       decision.includes(q) ||
-      hashPrefix.startsWith(q)
+      hashRaw.startsWith(q) ||
+      hashNormalized.includes(q)
     );
   });
 }

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/guard-types.ts

@@ -470,6 +470,7 @@ export type GuardArtifactDiff = {
 };
 
 export type GuardPolicyDecision = {
+  decision_id?: number;
   harness: string;
   scope: DecisionScope;
   artifact_id: string | null;
@@ -480,6 +481,10 @@ export type GuardPolicyDecision = {
   reason: string | null;
   source: string;
   updated_at: string;
+  source_receipt_id?: string | null;
+  remembered_command?: string | null;
+  remembered_context?: string | null;
+  workspace_label?: string | null;
 };
 
 export const GUARD_CLOUD_EXCEPTION_ACK_STATUSES = [

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/policy-remembered-local-rules.tsx

@@ -15,7 +15,7 @@ export function PolicyRememberedLocalRules({
   return (
     <GroupedPolicySection
       title="Remembered on this device"
-      description="Choices you saved from Inbox. Each card explains what Guard will do next time."
+      description="Choices you saved from Inbox. Each row shows the exact command or action Guard will remember, and where it applies."
       policies={policies}
       cloudControlsUrl={cloudControlsUrl}
       onClearPolicy={onClearPolicy}

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/policy-remembered-rules.test.tsx

@@ -52,10 +52,11 @@ assert(workspaceSource.includes("PolicyRememberedRulesTab"), "workspace uses rem
 assert(!workspaceSource.includes("PolicyRememberedRulesHelper"), "workspace no longer uses inline helper");
 assert(!workspaceSource.includes("GroupedPolicySection"), "workspace no longer mounts grouped sections directly");
 
-assert(viewsSource.includes("scopeLabel(policy.scope)"), "rule cards show explicit scope tag");
-assert(viewsSource.includes("See approval record"), "local cards link to approval record");
-assert(viewsSource.includes("View on cloud"), "cloud cards link to Guard Cloud");
-assert(viewsSource.includes("Remove rule"), "local cards expose remove action");
+assert(viewsSource.includes("Remembered action"), "rules table uses mockup-style columns");
+assert(viewsSource.includes("resolvePolicyApprovalRecordLabel"), "rules table links approval record by receipt id");
+assert(viewsSource.includes("display.rememberSentence"), "rules table explains remembered behavior");
+assert(viewsSource.includes("View on cloud"), "cloud rules link to Guard Cloud");
+assert(viewsSource.includes("Remove rule"), "local rules expose remove action");
 assert(viewsSource.includes("!cloudManaged"), "remove action gated to non-cloud rules");
 assert(viewsSource.includes("cloudManaged && cloudControlsUrl"), "cloud link gated to cloud-managed rules");
 

plugin_scanner-2.0.685/dashboard/src/policy-workspace-helpers.test.ts

@@ -0,0 +1,86 @@
+import type { GuardPolicyDecision } from "./guard-types";
+import {
+  resolvePolicyApprovalRecordLabel,
+  resolvePolicyDisplay,
+  resolvePolicyEvidenceHref,
+  resolvePolicyMatcherFamily,
+  resolveWorkspaceLabel,
+} from "./policy-workspace-helpers";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const basePolicy = (overrides: Partial<GuardPolicyDecision>): GuardPolicyDecision => ({
+  harness: "opencode",
+  scope: "workspace",
+  artifact_id: "opencode:project:package-request:62de981049ed20f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+  workspace: "workspace:c188b6362f81cac126242642b9d7baaa7026c681d5c5ea9e4cc92df615049faf",
+  publisher: null,
+  action: "allow",
+  reason: "approved in review",
+  source: "local",
+  updated_at: "2026-06-11T12:00:00.000Z",
+  ...overrides,
+});
+
+const enrichedPackageRule = basePolicy({
+  remembered_command: "pnpm install",
+  remembered_context: "Package install via pnpm",
+  workspace_label: "hol-points-portal",
+  source_receipt_id: "receipt-abc123",
+  artifact_hash: "sha256:62de981049ed20f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+});
+
+const enrichedDisplay = resolvePolicyDisplay(enrichedPackageRule);
+
+assert(enrichedDisplay.headline === "pnpm install", "POL-H1: enriched command becomes headline");
+assert(
+  enrichedDisplay.subtitle.includes("Package install via pnpm"),
+  "POL-H2: enriched context appears in subtitle",
+);
+assert(
+  enrichedDisplay.rememberSentence.includes("hol-points-portal"),
+  "POL-H3: remember sentence names project folder",
+);
+assert(
+  enrichedDisplay.rememberSentence.includes("pnpm install"),
+  "POL-H4: remember sentence repeats exact command",
+);
+
+const workspacePackageRule = basePolicy({});
+const display = resolvePolicyDisplay(workspacePackageRule);
+
+assert(!display.headline.includes("62de9810"), "POL-H5: headline must not expose artifact hash ids");
+assert(display.headline.toLowerCase().includes("package install"), "POL-H6: fallback names action family");
+
+const evidenceHref = resolvePolicyEvidenceHref(enrichedPackageRule);
+assert(evidenceHref.includes("selected=receipt-abc123"), "POL-H7: evidence link selects source receipt");
+assert(evidenceHref.includes("search=receipt-abc123"), "POL-H8: evidence link searches receipt id");
+
+const hashOnlyHref = resolvePolicyEvidenceHref(
+  basePolicy({
+    artifact_hash: "sha256:62de981049ed20f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+  }),
+);
+assert(hashOnlyHref.includes("search=62de981049ed"), "POL-H9: hash fallback strips sha256 prefix");
+
+assert(
+  resolvePolicyApprovalRecordLabel(enrichedPackageRule) === "receipt-abc123.json",
+  "POL-H10: approval record label uses receipt filename",
+);
+
+assert(
+  resolveWorkspaceLabel("workspace:c188b6362f81cac126242642b9d7baaa7026c681d5c5ea9e4cc92df615049faf") ===
+    "this project",
+  "POL-H11: workspace hash labels collapse to this project",
+);
+
+assert(
+  resolvePolicyMatcherFamily(basePolicy({ artifact_id: "family:tool-action" })) === "tool-action",
+  "POL-H12: family matcher ids parse correctly",
+);
+
+console.log("policy-workspace-helpers.test.ts: all assertions passed");

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/policy-workspace-helpers.ts

@@ -2,13 +2,13 @@ import type { GuardPolicyDecision } from "./guard-types";
 import { harnessDisplayName, policyActionLabel, scopeLabel } from "./approval-center-utils";
 
 const MATCHER_FAMILY_LABELS: Record<string, string> = {
-  "package-request": "package install",
-  "tool-action": "shell or tool command",
-  "tool-output": "command output review",
-  prompt: "prompt submission",
-  "prompt-env-read": "environment variable read",
+  "package-request": "Package install",
+  "tool-action": "Shell or tool command",
+  "tool-output": "Command output review",
+  prompt: "Prompt submission",
+  "prompt-env-read": "Environment variable read",
   mcp: "MCP server call",
-  "file-read": "file read",
+  "file-read": "File read",
 };
 
 const GENERIC_REASONS = [
@@ -21,6 +21,7 @@ const GENERIC_REASONS = [
 export type PolicyDisplay = {
   headline: string;
   subtitle: string;
+  rememberSentence: string;
   technicalId: string | null;
 };
 
@@ -33,7 +34,7 @@ export function resolvePolicySourceLabel(source: string): string {
     return "Guard Cloud";
   }
   if (source === "manual" || source === "local") {
-    return "This device";
+    return "Local";
   }
   return source.replace(/_/g, " ");
 }
@@ -82,7 +83,7 @@ function resolvePromptSubtypeLabel(artifactId: string): string | null {
   const parts = artifactId.split(":");
   const promptIndex = parts.indexOf("prompt");
   if (promptIndex < 0) {
-    return null;
+    return "prompt review";
   }
   const subtype = parts[promptIndex + 1];
   if (!subtype) {
@@ -99,7 +100,7 @@ export function resolveWorkspaceLabel(workspace: string | null | undefined): str
   if (value.startsWith("workspace:")) {
     return "this project";
   }
-  if (value.startsWith("/")) {
+  if (value.startsWith("/") || value.startsWith("~")) {
     const segments = value.split("/").filter(Boolean);
     return segments[segments.length - 1] ?? "this project";
   }
@@ -119,23 +120,48 @@ function resolveActionVerb(action: string): string {
   return policyActionLabel(action);
 }
 
+function resolveRememberSentence(policy: GuardPolicyDecision, commandLabel: string): string {
+  const app = harnessDisplayName(policy.harness);
+  const folder = policy.workspace_label?.trim() || resolveWorkspaceLabel(policy.workspace);
+  const verb = policy.action === "block" ? "block" : "allow";
+
+  if (policy.scope === "artifact") {
+    return `Guard will ${verb} "${commandLabel}" the next time ${app} retries this exact action.`;
+  }
+  if (policy.scope === "workspace") {
+    return `Guard will ${verb} "${commandLabel}" every time ${app} runs it in ${folder}.`;
+  }
+  if (policy.scope === "harness") {
+    return `Guard will ${verb} "${commandLabel}" every time ${app} runs a matching action.`;
+  }
+  if (policy.scope === "publisher") {
+    const publisher = policy.publisher?.trim() || "this publisher";
+    return `Guard will ${verb} actions from ${publisher} in ${app}.`;
+  }
+  if (policy.scope === "global") {
+    return `Guard will ${verb} matching actions on every project on this device.`;
+  }
+  return `Guard will ${verb} matching actions when ${scopeLabel(policy.scope).toLowerCase()} rules apply.`;
+}
+
 function resolveScopeSubtitle(policy: GuardPolicyDecision): string {
   const app = harnessDisplayName(policy.harness);
   if (policy.scope === "artifact") {
-    return `Applies once in ${app}`;
+    return `Once in ${app}`;
   }
   if (policy.scope === "workspace") {
-    return `Applies every time in ${resolveWorkspaceLabel(policy.workspace)} (${app})`;
+    const folder = policy.workspace_label?.trim() || resolveWorkspaceLabel(policy.workspace);
+    return `This project · ${folder}`;
   }
   if (policy.scope === "harness") {
-    return `Applies every time in ${app}`;
+    return `Every time in ${app}`;
   }
   if (policy.scope === "publisher") {
     const publisher = policy.publisher?.trim() || "this publisher";
-    return `Applies to ${publisher} in ${app}`;
+    return `${publisher} in ${app}`;
   }
   if (policy.scope === "global") {
-    return "Applies on every project on this device";
+    return "Every project on this device";
   }
   return scopeLabel(policy.scope);
 }
@@ -158,13 +184,13 @@ function resolveWhatPhrase(policy: GuardPolicyDecision): string {
 
   if (familyPhrase) {
     if (artifactId.startsWith("family:") || policy.scope === "harness") {
-      return `all ${familyPhrase}s`;
+      return `all ${familyPhrase.toLowerCase()}s`;
     }
     if (family === "prompt") {
       const subtype = resolvePromptSubtypeLabel(artifactId);
       return subtype ? `${familyPhrase} (${subtype})` : familyPhrase;
     }
-    return familyPhrase;
+    return familyPhrase.toLowerCase();
   }
 
   if (publisher) {
@@ -174,31 +200,61 @@ function resolveWhatPhrase(policy: GuardPolicyDecision): string {
   return "matching guarded actions";
 }
 
+function resolveContextLine(policy: GuardPolicyDecision): string | null {
+  const remembered = policy.remembered_context?.trim();
+  if (remembered) {
+    return remembered;
+  }
+  const family = policy.artifact_id ? extractMatcherFamily(policy.artifact_id) : null;
+  if (family && MATCHER_FAMILY_LABELS[family]) {
+    return MATCHER_FAMILY_LABELS[family];
+  }
+  return null;
+}
+
 export function resolvePolicyDisplay(policy: GuardPolicyDecision): PolicyDisplay {
   const reason = policy.reason?.trim() ?? null;
+  const rememberedCommand = policy.remembered_command?.trim();
+  const contextLine = resolveContextLine(policy);
+
+  if (rememberedCommand) {
+    return {
+      headline: rememberedCommand,
+      subtitle: [contextLine, resolveScopeSubtitle(policy)].filter(Boolean).join(" · "),
+      rememberSentence: resolveRememberSentence(policy, rememberedCommand),
+      technicalId: policy.artifact_id,
+    };
+  }
+
   const actionVerb = resolveActionVerb(policy.action);
 
   if (reason && !isGenericReason(reason)) {
     return {
-      headline: `${actionVerb}: ${reason}`,
-      subtitle: resolveScopeSubtitle(policy),
+      headline: reason,
+      subtitle: [contextLine, resolveScopeSubtitle(policy)].filter(Boolean).join(" · "),
+      rememberSentence: resolveRememberSentence(policy, reason),
       technicalId: policy.artifact_id,
     };
   }
 
   const what = resolveWhatPhrase(policy);
+  const headline = `${actionVerb} ${what}`;
   return {
-    headline: `${actionVerb} ${what}`,
-    subtitle: resolveScopeSubtitle(policy),
+    headline,
+    subtitle: [contextLine, resolveScopeSubtitle(policy)].filter(Boolean).join(" · "),
+    rememberSentence: resolveRememberSentence(policy, what),
     technicalId: policy.artifact_id,
   };
 }
 
 export function resolvePolicyEvidenceSearchTerm(policy: GuardPolicyDecision): string | null {
+  const receiptId = policy.source_receipt_id?.trim();
+  if (receiptId) {
+    return receiptId;
+  }
   const hash = policy.artifact_hash?.trim();
   if (hash) {
-    const normalized = hash.replace(/^sha256:/i, "");
-    return normalized.slice(0, 12);
+    return hash.replace(/^sha256:/i, "").slice(0, 12);
   }
   const target = policyTargetLabel(policy);
   if (!target || target === "Global") {
@@ -217,6 +273,12 @@ export function resolvePolicyEvidenceSearchTerm(policy: GuardPolicyDecision): st
 
 export function resolvePolicyEvidenceHref(policy: GuardPolicyDecision): string {
   const params = new URLSearchParams();
+  const receiptId = policy.source_receipt_id?.trim();
+  if (receiptId) {
+    params.set("selected", receiptId);
+    params.set("search", receiptId);
+    return `/evidence?${params.toString()}`;
+  }
   const searchTerm = resolvePolicyEvidenceSearchTerm(policy);
   if (searchTerm) {
     params.set("search", searchTerm);
@@ -225,6 +287,18 @@ export function resolvePolicyEvidenceHref(policy: GuardPolicyDecision): string {
   return query ? `/evidence?${query}` : "/evidence";
 }
 
+export function resolvePolicyApprovalRecordLabel(policy: GuardPolicyDecision): string {
+  const receiptId = policy.source_receipt_id?.trim();
+  if (receiptId) {
+    return `${receiptId}.json`;
+  }
+  const hash = policy.artifact_hash?.replace(/^sha256:/i, "").slice(0, 8);
+  if (hash) {
+    return `receipt_${hash}.json`;
+  }
+  return "View in Evidence";
+}
+
 export function resolveCloudPolicyControlsUrl(snapshot: {
   dashboard_url?: string | null;
   connect_url?: string | null;
@@ -272,9 +346,9 @@ export function resolveSecurityModeCopy(
 ): { label: string; description: string; tone: "green" | "attention" | "slate" } {
   if (level === "strict") {
     return {
-      label: "Strict mode",
+      label: "Protect",
       description:
-        "Guard asks before most actions including new network connections and file writes. Higher noise, maximum protection.",
+        "Guard asks before risky actions that are not already allowed by policy, remembered rules, or Cloud exceptions.",
       tone: "attention",
     };
   }
@@ -304,9 +378,12 @@ export function resolveCloudPolicyBundleCopy(snapshot: {
   cloud_policy_bundle_version?: string | null;
   cloud_policy_rollout_state?: string | null;
   cloud_policy_sync_error?: string | null;
+  cloud_policy_bundle_hash?: string | null;
+  cloud_policy_last_ack_at?: string | null;
 }): {
   label: string;
   detail: string;
+  hash: string | null;
   tone: "green" | "attention" | "slate";
 } | null {
   const bundleVersion = snapshot.cloud_policy_bundle_version?.trim();
@@ -315,16 +392,19 @@ export function resolveCloudPolicyBundleCopy(snapshot: {
   }
   const rollout = snapshot.cloud_policy_rollout_state?.trim() || "unknown";
   const syncError = snapshot.cloud_policy_sync_error?.trim();
+  const hash = snapshot.cloud_policy_bundle_hash?.trim() || null;
   if (syncError) {
     return {
-      label: `Cloud bundle ${bundleVersion}`,
-      detail: `Guard Cloud Controls owns rollout and authoring. Latest sync issue: ${syncError}.`,
+      label: "Needs attention",
+      detail: `Bundle ${bundleVersion} is connected, but the latest sync reported: ${syncError}`,
+      hash,
       tone: "attention",
     };
   }
   return {
-    label: `Cloud bundle ${bundleVersion}`,
-    detail: `Guard Cloud Controls owns authoring and rollout. This local workspace reflects rollout state ${rollout}.`,
+    label: "Synced",
+    detail: `Bundle ${bundleVersion} is active on this device (${rollout}).`,
+    hash,
     tone: "green",
   };
 }

{plugin_scanner-2.0.684 → plugin_scanner-2.0.685}/dashboard/src/policy-workspace-views.tsx

@@ -1,11 +1,22 @@
 import { useCallback, useMemo, useState } from "react";
-import { HiMiniTrash, HiMiniCloudArrowUp, HiMiniChevronDown, HiMiniChevronUp } from "react-icons/hi2";
+import {
+  HiMiniTrash,
+  HiMiniCloudArrowUp,
+  HiMiniChevronDown,
+  HiMiniChevronUp,
+  HiMiniCommandLine,
+  HiMiniCube,
+  HiMiniDocumentText,
+  HiMiniGlobeAlt,
+  HiMiniShieldCheck,
+} from "react-icons/hi2";
 import { Badge, Tag, EmptyState } from "./approval-center-primitives";
 import { harnessDisplayName, formatRelativeTime, policyActionLabel, scopeLabel } from "./approval-center-utils";
 import { guardAwareHref } from "./guard-api";
 import type { GuardPolicyDecision } from "./guard-types";
 import {
   isCloudManagedPolicy,
+  resolvePolicyApprovalRecordLabel,
   resolvePolicyDisplay,
   resolvePolicyEvidenceHref,
   resolvePolicyMatcherFamily,
@@ -30,47 +41,69 @@ function resolveActionTone(action: string): "success" | "destructive" | "warning
   return "default";
 }
 
-type PolicyRuleCardProps = {
+function resolveFamilyIcon(family: string | null) {
+  if (family === "package-request") {
+    return HiMiniCube;
+  }
+  if (family === "tool-action" || family === "tool-output") {
+    return HiMiniCommandLine;
+  }
+  if (family === "prompt" || family === "prompt-env-read") {
+    return HiMiniDocumentText;
+  }
+  if (family === "mcp") {
+    return HiMiniGlobeAlt;
+  }
+  return HiMiniShieldCheck;
+}
+
+type PolicyRuleRowProps = {
   policy: GuardPolicyDecision;
   cloudControlsUrl: string | null;
   onClear?: (policy: GuardPolicyDecision) => void;
 };
 
-export function PolicyRuleCard({ policy, cloudControlsUrl, onClear }: PolicyRuleCardProps) {
+function PolicyRuleRow({ policy, cloudControlsUrl, onClear }: PolicyRuleRowProps) {
   const handleClear = useCallback(() => onClear?.(policy), [onClear, policy]);
   const cloudManaged = isCloudManagedPolicy(policy.source);
   const display = resolvePolicyDisplay(policy);
   const canClear = onClear !== undefined && !cloudManaged;
+  const family = resolvePolicyMatcherFamily(policy);
+  const Icon = resolveFamilyIcon(family);
 
   return (
-    <article className="rounded-2xl border border-slate-100 bg-white px-4 py-3.5 shadow-sm">
-      <div className="flex flex-wrap items-start justify-between gap-3">
-        <div className="min-w-0 flex-1 space-y-1.5">
-          <div className="flex flex-wrap items-center gap-2">
+    <tr className="border-b border-slate-100 last:border-0 hover:bg-slate-50/80">
+      <td className="px-3 py-3 align-top">
+        <div className="flex items-start gap-2">
+          <span className="mt-0.5 flex h-8 w-8 shrink-0 items-center justify-center rounded-xl bg-slate-100 text-slate-500">
+            <Icon className="h-4 w-4" aria-hidden="true" />
+          </span>
+          <div className="min-w-0 space-y-1">
             <Badge tone={resolveActionTone(policy.action)}>{policyActionLabel(policy.action)}</Badge>
-            <Tag tone={cloudManaged ? "blue" : "green"}>{resolvePolicySourceLabel(policy.source)}</Tag>
-            <Tag tone="slate">{scopeLabel(policy.scope)}</Tag>
-            <span className="text-xs text-slate-400">{harnessDisplayName(policy.harness)}</span>
+            <p className="text-sm font-semibold leading-snug text-brand-dark">{display.headline}</p>
+            {display.subtitle ? <p className="text-xs text-slate-500">{display.subtitle}</p> : null}
+            <p className="text-xs leading-relaxed text-slate-600">{display.rememberSentence}</p>
           </div>
-          <h3 className="text-base font-semibold leading-snug text-brand-dark">{display.headline}</h3>
-          <p className="text-sm text-slate-600">{display.subtitle}</p>
-          {display.technicalId ? (
-            <details className="text-xs text-slate-500">
-              <summary className="cursor-pointer text-brand-blue hover:underline">Technical id</summary>
-              <p className="mt-1 break-all font-mono text-[11px] text-slate-600">{display.technicalId}</p>
-            </details>
-          ) : null}
         </div>
-        <div className="flex shrink-0 flex-col items-end gap-2 text-right">
-          <span className="text-xs text-slate-400">
-            {policy.updated_at ? formatRelativeTime(policy.updated_at) : null}
-          </span>
+      </td>
+      <td className="hidden px-3 py-3 align-top text-sm text-slate-600 md:table-cell">
+        <Tag tone={cloudManaged ? "blue" : "green"}>{resolvePolicySourceLabel(policy.source)}</Tag>
+      </td>
+      <td className="hidden px-3 py-3 align-top text-sm text-slate-600 lg:table-cell">{scopeLabel(policy.scope)}</td>
+      <td className="hidden px-3 py-3 align-top text-sm text-slate-600 xl:table-cell">
+        {harnessDisplayName(policy.harness)}
+      </td>
+      <td className="hidden px-3 py-3 align-top text-xs text-slate-500 sm:table-cell">
+        {policy.updated_at ? formatRelativeTime(policy.updated_at) : "—"}
+      </td>
+      <td className="px-3 py-3 align-top text-right">
+        <div className="flex flex-col items-end gap-2">
           {!cloudManaged ? (
             <a
               href={guardAwareHref(resolvePolicyEvidenceHref(policy))}
               className="text-sm font-medium text-brand-blue hover:underline"
             >
-              See approval record
+              {resolvePolicyApprovalRecordLabel(policy)}
             </a>
           ) : null}
           {cloudManaged && cloudControlsUrl ? (
@@ -95,12 +128,12 @@ export function PolicyRuleCard({ policy, cloudControlsUrl, onClear }: PolicyRule
             </button>
           ) : null}
         </div>
-      </div>
-    </article>
+      </td>
+    </tr>
   );
 }
 
-type PolicyRuleListProps = {
+type PolicyRuleTableProps = {
   policies: GuardPolicyDecision[];
   cloudControlsUrl: string | null;
   onClearPolicy?: (policy: GuardPolicyDecision) => void;
@@ -108,7 +141,13 @@ type PolicyRuleListProps = {
   emptyBody: string;
 };
 
-export function PolicyRuleList({ policies, cloudControlsUrl, onClearPolicy, emptyTitle, emptyBody }: PolicyRuleListProps) {
+export function PolicyRuleTable({
+  policies,
+  cloudControlsUrl,
+  onClearPolicy,
+  emptyTitle,
+  emptyBody,
+}: PolicyRuleTableProps) {
   const [visibleCount, setVisibleCount] = useState(PAGE_SIZE);
 
   const visiblePolicies = useMemo(() => policies.slice(0, visibleCount), [policies, visibleCount]);
@@ -124,14 +163,30 @@ export function PolicyRuleList({ policies, cloudControlsUrl, onClearPolicy, empt
 
   return (
     <div className="space-y-3">
-      {visiblePolicies.map((policy) => (
-        <PolicyRuleCard
-          key={`${policy.harness}-${policy.scope}-${policy.artifact_id ?? policy.publisher ?? "global"}-${policy.updated_at ?? ""}-${policy.source}`}
-          policy={policy}
-          cloudControlsUrl={cloudControlsUrl}
-          onClear={onClearPolicy}
-        />
-      ))}
+      <div className="overflow-x-auto rounded-2xl border border-slate-100 bg-white shadow-sm">
+        <table className="min-w-full border-collapse text-left">
+          <thead className="border-b border-slate-100 bg-slate-50/80 text-xs font-semibold uppercase tracking-wide text-slate-500">
+            <tr>
+              <th className="px-3 py-3">Remembered action</th>
+              <th className="hidden px-3 py-3 md:table-cell">Source</th>
+              <th className="hidden px-3 py-3 lg:table-cell">Scope</th>
+              <th className="hidden px-3 py-3 xl:table-cell">Harness</th>
+              <th className="hidden px-3 py-3 sm:table-cell">Last updated</th>
+              <th className="px-3 py-3 text-right">Record</th>
+            </tr>
+          </thead>
+          <tbody>
+            {visiblePolicies.map((policy) => (
+              <PolicyRuleRow
+                key={`${policy.harness}-${policy.scope}-${policy.artifact_id ?? policy.publisher ?? "global"}-${policy.updated_at ?? ""}-${policy.source}`}
+                policy={policy}
+                cloudControlsUrl={cloudControlsUrl}
+                onClear={onClearPolicy}
+              />
+            ))}
+          </tbody>
+        </table>
+      </div>
       {hasMore ? (
         <div className="flex justify-center pt-1">
           <button
@@ -205,7 +260,7 @@ export function GroupedPolicySection({
         </div>
       </button>
       {open ? (
-        <PolicyRuleList
+        <PolicyRuleTable
           policies={policies}
           cloudControlsUrl={cloudControlsUrl}
           onClearPolicy={onClearPolicy}